Trojan:MSIL/FormBook.AFB!MTB removal guide

The Trojan:MSIL/FormBook.AFB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/FormBook.AFB!MTB virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan:MSIL/FormBook.AFB!MTB?


File Info:
name: ED2FCE4F08D4B4EBBC73.mlw
path: /opt/CAPEv2/storage/binaries/22da6798edf7ecbc018e132ff61dff54b38704226c0f4693e8981b112e69eafc
crc32: 942A3804
md5: ed2fce4f08d4b4ebbc737100e1a9f656
sha1: 428f3ab10037c2c5e18356f9b72c8d95cd0548a6
sha256: 22da6798edf7ecbc018e132ff61dff54b38704226c0f4693e8981b112e69eafc
sha512: 36a0ce79944afb2a2cfb9250236a9b727fd9c3450632c9b03ddde6c6b315f584b518f1de30a4f0f5071ab2bdd3b1116b0a88783d016ae27a4f957e379eb05612
ssdeep: 12288:G8669yqLzvwX/MaKXMo8nby+dCTikUSBnf6WeBPgVBANPXeVUoKACYxhw1V:+6X3IXhKXM1NCTlpxCBPgVyNPXehKYxy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T101D4224231AA6F01C77CE3B55AB2916463F64B298B33DB6D1DDC22CB49B3B5803A5743
sha3_384: 7cb989d42bcbb72b3e9f128d104ac1626bba3a7965dd4636775c05f44f6256a039d7031d8cc0b6ae170e02247602a91c
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-10-30 08:18:50

Version Info:
Translation: 0x0000 0x04b0
Comments: Notepad
CompanyName: 
FileDescription: Formatter
FileVersion: 1.2.0.0
InternalName: xxmksh.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: xxmksh.exe
ProductName: Formatter
ProductVersion: 1.2.0.0
Assembly Version: 4.0.3.0

Trojan:MSIL/FormBook.AFB!MTB also known as:

MicroWorld-eScan	Gen:Variant.Barys.51935
FireEye	Gen:Variant.Barys.51935
Skyhigh	BehavesLike.Win32.Generic.jc
ALYac	Gen:Variant.Barys.51935
VIPRE	Gen:Variant.Barys.51935
Sangfor	Suspicious.Win32.Save.a
BitDefender	Gen:Variant.Barys.51935
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GNHC
APEX	Malicious
Kaspersky	VHO:Trojan-PSW.MSIL.Disco.gen
Alibaba	Trojan:MSIL/FormBook.5cc9be08
Emsisoft	Gen:Variant.Barys.51935 (B)
Sophos	Troj/Krypt-ABH
MAX	malware (ai score=82)
Google	Detected
Microsoft	Trojan:MSIL/FormBook.AFB!MTB
Arcabit	Trojan.Barys.DCADF
ZoneAlarm	VHO:Trojan-PSW.MSIL.Disco.gen
GData	Gen:Variant.Barys.51935
Cynet	Malicious (score: 100)
DeepInstinct	MALICIOUS
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.ATU!tr
AVG	PWSX-gen [Trj]
Avast	PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Trojan:MSIL/FormBook.AFB!MTB?

Trojan:MSIL/FormBook.AFB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X