How to remove “Trojan-Dropper.Win32.Foma.b”?

The Trojan-Dropper.Win32.Foma.b is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-Dropper.Win32.Foma.b virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid

How to determine Trojan-Dropper.Win32.Foma.b?


File Info:
name: 356D1AF1ED155503E3AE.mlw
path: /opt/CAPEv2/storage/binaries/202026cdf7266c16adee4881ade8b0ba0dd6c475ee0a73bc2af11c0c88495f1e
crc32: B81579EF
md5: 356d1af1ed155503e3aee9f882dfe44b
sha1: 8ffe7e007f39f84eec21baa7c4cc217ff4ccebf1
sha256: 202026cdf7266c16adee4881ade8b0ba0dd6c475ee0a73bc2af11c0c88495f1e
sha512: 011729e418a4bba8fd861e89805abf1fe8f1a77ab2034248da6609c010276d29b10b0650b030b033b534f84a97b5b2b5dfa21e4200805f0e210281ed7e0e7d48
ssdeep: 384:WFXmjkaU9jtcnwad3H13mcHqrZBkJDRdH3hWTPhW:WFXemna9H12IWuDq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A3E2F66AABD24BA1E150D9311B3A1377B737A4297F2487EF4768ED2C04331415D3A38E
sha3_384: 727b4d5c14e4223aef74df9cd77e7d74d31f32df799462d2c602fcf5151546171cd8292e1b7718a487b210583adc461b
ep_bytes: 558bec6aff683848400068202d400064
timestamp: 2010-07-02 10:01:41

Version Info:
Comments: 
CompanyName: Microsoft Corporation
FileDescription: Microsoft   Explorer
FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
InternalName: Explorer.exe
LegalCopyright: 2008
LegalTrademarks: 
OriginalFilename: Explorer.exe
PrivateBuild: 
ProductName: Microsoft  Windows  Operating System Explorer
ProductVersion: 1, 0, 0, 1
SpecialBuild: 5.1.2600.3093
Translation: 0x0804 0x04b0

Trojan-Dropper.Win32.Foma.b also known as:

Lionic	Trojan.Win32.Foma.b!c
MicroWorld-eScan	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
FireEye	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
Cylance	Unsafe
Alibaba	TrojanDropper:Win32/Generic.42c562c8
Cybereason	malicious.1ed155
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Dropper.Win32.Foma.b
BitDefender	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
NANO-Antivirus	Trojan.Win32.Foma.ecntnd
Avast	Win32:Malware-gen
Rising	Dropper.Foma!8.12367 (CLOUD)
Ad-Aware	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
Emsisoft	Gen:Trojan.Heur.RP.cq0@bm!ExVgb (B)
VIPRE	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
GData	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
Jiangmin	TrojanDropper.Foma.a
Antiy-AVL	Trojan/Generic.ASMalwS.4771
Kingsoft	Win32.Troj.Generic.a.(kcloud)
Arcabit	Trojan.Heur.RP.E1E940
Microsoft	Trojan:Win32/Wacatac.B!ml
ALYac	Gen:Trojan.Heur.RP.cq0@bm!ExVgb
MAX	malware (ai score=87)
VBA32	TrojanDropper.Foma
Tencent	Win32.Trojan-dropper.Foma.Ljar
Yandex	Trojan.DR.Foma!j826UsswQkU
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Foma.B!tr
BitDefenderTheta	AI:Packer.17C039211F
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_70% (W)

How to remove Trojan-Dropper.Win32.Foma.b?

Trojan-Dropper.Win32.Foma.b removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X