Trojan:Win32/Barys.GMA!MTB removal tips

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Creates a copy of itself
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Barys.GMA!MTB?

File Info:
name: 1CD138C0E6784985AE96.mlw
path: /opt/CAPEv2/storage/binaries/9695441b0bf6575cd50f22ab3cdadc6daffe4be9e4fd6536c51987fb2f03e551
crc32: 2C959014
md5: 1cd138c0e6784985ae96e17a864d171e
sha1: 2442be4668c75bd7526c7731b81f088d2caf77ff
sha256: 9695441b0bf6575cd50f22ab3cdadc6daffe4be9e4fd6536c51987fb2f03e551
sha512: 0d978295967ec7a0fe4a8c03fe7f0f9fea5eecaa4d3b79b83a68516ae69a3ef4a26bdb0939361dec78fd68e14ed3071e32df3667d08b536c25c92b8db8604a70
ssdeep: 12288:bhVHC0ph6XFRbf0ez0npM4dl0v5Jdm5IpXt1U:bhXph6XFRbf0ezEM4dmv5BJtO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T104C4CF76731DDEC1CF3A2BBF1F5973066453992FE629601E604C870A52A2FE244DB293
sha3_384: f33e2a79096cfa3c237a89068567a767b9dc1fda946a81845f9ec52adb583368e44929377b3c2b0164e3a9dd9fd93c6c
ep_bytes: 05543109550d858e50dcbc1f929fd4a5
timestamp: 1971-05-16 00:00:00

Version Info:
CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

How to remove Trojan:Win32/Barys.GMA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.