Trojan:MSIL/FormBook.KA!MTB removal guide

The Trojan:MSIL/FormBook.KA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:MSIL/FormBook.KA!MTB virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:MSIL/FormBook.KA!MTB?


File Info:
crc32: 150F07A5
md5: bd1348111aebafff0e409c1b2103be2f
name: BD1348111AEBAFFF0E409C1B2103BE2F.mlw
sha1: c4c0c935e0567d37e8e1b3b142f00b8b068c6367
sha256: 2803e9209af7ffdb7789624470fc34e95b2c1ad4384b9c9b289eb299d4f542d8
sha512: 220162506e0f9fa1d6f65b656cb7525f0481d5804b4bfdafb749b90fd0ebf18a2572cb3829cb1d34ce978d9fe1c451655371dce400637e9e5f970a042eed9e42
ssdeep: 6144:9oUuoNX+Bf4C/n0O+n0VJHEe9HqfoqGDeegQ/dEq4itvy4t9MmztLxtlT:97ut40DJHEe9HqLQ/H4itvy4tuqLL1
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Rolling Thunder 2009
Assembly Version: 5.0.0.0
InternalName: BinaryWrit.exe
FileVersion: 2.0.0.0
CompanyName: Rolling Thunder
LegalTrademarks: 
Comments: Administrative Aupport Specialist
ProductName: IrcBot
ProductVersion: 2.0.0.0
FileDescription: IrcBo
OriginalFilename: BinaryWrit.exe

Trojan:MSIL/FormBook.KA!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37949232
CAT-QuickHeal	Trojan.FormBook
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.ky
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 00589ee91 )
K7AntiVirus	Trojan ( 00589ee91 )
BitDefenderTheta	Gen:NN.ZemsilF.34266.zm0@aOqBpYf
Cyren	W32/MSIL_Kryptik.GAQ.gen!Eldorado
Symantec	MSIL.Packed.19
ESET-NOD32	a variant of MSIL/GenKryptik.FNBG
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
Alibaba	Trojan:Win32/Kryptik.ali2000016
Ad-Aware	Trojan.GenericKD.37949232
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.UMal.zdnuw@0
DrWeb	Trojan.Siggen15.35225
TrendMicro	TROJ_FRS.0NA103K521
FireEye	Generic.mg.bd1348111aebafff
Emsisoft	Trojan.Crypt (A)
SentinelOne	Static AI – Malicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.pdmgl
Arcabit	Trojan.Generic.D2430F30
Microsoft	Trojan:MSIL/FormBook.KA!MTB
AhnLab-V3	Trojan/Win.MalwareX-gen.C4753835
MAX	malware (ai score=99)
Malwarebytes	Trojan.AgentTesla
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_FRS.0NA103K521
Yandex	Trojan.GenKryptik!a9c1AzURE/k
Ikarus	Trojan.MSIL.IRCBot
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FNAJ!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

How to remove Trojan:MSIL/FormBook.KA!MTB?

Trojan:MSIL/FormBook.KA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:MSIL/FormBook.KA!MTB removal guide