Trojan:Win32/FormBook.AMP!MTB removal

The Trojan:Win32/FormBook.AMP!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/FormBook.AMP!MTB virus can do?

Reads data out of its own binary image
Unconventionial language used in binary resources: Russian
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan:Win32/FormBook.AMP!MTB?


File Info:
crc32: 1F6E1570
md5: fe3ec61798741f90f745a0f508f78c33
name: FE3EC61798741F90F745A0F508F78C33.mlw
sha1: a61540c961cbc8cc90715c610ec7e957d4153757
sha256: 13e353b5aaf0a49286d0148954759cf4eb844087f28bf0be58f9fe0f8c9df947
sha512: 78fee25e34482064bdcbcdb1681c4156d6ecf5db1ede0273cbe8b8e887bd30a30c1fc9f4fc8bd4d7921321386d8728ddc4dfdd0ab44b1c76ed3a490b23d2e9ee
ssdeep: 196608:ytgZqGeTGDbev2aL8bpXxOUu8q7WtnlpWGj8zPMw4XtPRk4R3BxCkfHOU08:bqGeTGWv2hlJj8SXtPR/3BxZHlX
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Cedar Lake Ventures, Inc.                                                                         
FileDescription: Vector Magic 1.15 Portable Win x32+x64 Multi Prxe9activxe9 1.15 
FileVersion: 1.15                
Comments: 
CompanyName: xa9 Cedar Lake Ventures, Inc.                                 
Translation: 0x0409 0x04e4

Trojan:Win32/FormBook.AMP!MTB also known as:

K7AntiVirus	Trojan ( 0057e0fb1 )
DrWeb	Trojan.Loader.842
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Nanobot
ALYac	Trojan.GenericKD.37374199
Cylance	Unsafe
Sangfor	Trojan.Win32.NanoBot.zit
Alibaba	Trojan:Win32/NanoBot.8e027961
K7GW	Trojan ( 0057e0fb1 )
Cybereason	malicious.961cbc
Cyren	W32/Ninjector.J.gen!Camelot
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	NSIS/Injector.AME
APEX	Malicious
Avast	NSIS:PWSX-gen [Trj]
Kaspersky	Trojan.Win32.NanoBot.zit
BitDefender	Trojan.GenericKD.37374199
MicroWorld-eScan	Trojan.GenericKD.37374199
Ad-Aware	Trojan.GenericKD.37374199
Sophos	Mal/Generic-S (PUA)
TrendMicro	TROJ_GEN.R002C0DHC21
McAfee-GW-Edition	BehavesLike.Win32.Dropper.wc
FireEye	Trojan.GenericKD.37374199
Emsisoft	Trojan.GenericKD.37374199 (B)
Avira	HEUR/AGEN.1144366
Kingsoft	Win32.Troj.NanoBot.z.(kcloud)
Microsoft	Trojan:Win32/FormBook.AMP!MTB
GData	Trojan.GenericKD.37374199
AhnLab-V3	Trojan/Win.Generic.C4589408
McAfee	Artemis!FE3EC6179874
MAX	malware (ai score=82)
VBA32	Trojan.Loader
Malwarebytes	Malware.AI.1848500008
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DHC21
Ikarus	Trojan.NSIS.Injector
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Fortinet	W32/AME!tr
AVG	NSIS:PWSX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Heur.Generic.HwUBueAA

How to remove Trojan:Win32/FormBook.AMP!MTB?

Trojan:Win32/FormBook.AMP!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X