Should I remove “Trojan:Win32/Barys.GMA!MTB”?

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Creates a copy of itself
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Barys.GMA!MTB?

File Info:
name: 2F7F71D7BF747A333642.mlw
path: /opt/CAPEv2/storage/binaries/c13919718deda24358930213b6f1cd113d4a28423e8e1324f45a2284c9c8f734
crc32: 74A16BA6
md5: 2f7f71d7bf747a333642e9bd2075a3b6
sha1: 18898de26b78e1aac65b77cdc51c6d778d3b0cc9
sha256: c13919718deda24358930213b6f1cd113d4a28423e8e1324f45a2284c9c8f734
sha512: 0be5f98b351c1bf56b9826bae2c49d35d64af029b8189e5ca319a1ecbe8e986ae03f9f5661c3e5daca5323f4dddccfaf76a6c181daa7a84bcf4a6723c75626d4
ssdeep: 6144:Pt6tYRTcaU5pr53BDu0W7cyqCxSngmMBqfycuPbUl0i5cD5J6K1mx1O:Pt6sThopr53p80npM4dl0v5Jdmo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12AA4BE86765CED15CA7A273B38E8B216A8809D9EED79AD4E6C44CF074963DF3870F101
sha3_384: 2495a0418b2f3f57a5bcbf931cc03d28f6af146accf74f09b75da01d84a636e1a7dbd03412e3263bf440f5f5d46fd989
ep_bytes: e7bbde1fb7e26a98b233530970703bb3
timestamp: 1976-11-05 00:00:00

Version Info:
CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

How to remove Trojan:Win32/Barys.GMA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.