FormBook Removal Guide

FormBook is a Trojan infection, so it can install on the system without any permission and the user’s knowledge. Apparently, while it is hiding from the user, it can collect various information, e.g., your passwords, banking account’s details, etc. In fact, the malware might steal any information you type while browsing the Internet, working with various applications, etc. Needless to say, such data could be later used by the threat’s creators for malicious purposes. Unfortunately, it is difficult to say how one might catch this Trojan because it looks like it is being rented or sold on the black market. Consequently, anyone could purchase it and distribute it as they want. In any case, if you think FormBook is on your computer, you should make sure it gets erased immediately. We will add deletion instructions at the end of this article, but instead of following them we would recommend employing a reliable security tool. That is because the malware’s removal is a complicated task and there are no reassurances our provided steps will help you get rid of it.

Our specialists found out the Trojan can be rented for one week, one month, or three months and the price goes from $29 to $99. The lifetime license allowing to use FormBook for as long as one wishes costs $299. Moreover, when one purchases the rented package, he receives access to a particular server where he can slightly chance some of the malicious program's settings according to his needs and then distribute it as he likes. Those who buy the lifetime version receive a Bin file for his domain; it lets the hacker host FormBook’s panel on his own server. Again, those who buy or rent the threat can spread the malware in any way they can think of, e.g., it might be sent to victims via infected email attachments, or the victim could download it himself from malicious file-sharing web pages or other doubtful sites.

Soon after the Trojan gets in it should start creating various randomly titled files in the %USERPROFILE%, %APPDATA%, %TEMP%, %PROGRAMFILES%, or any other folders as well. Our specialists say some of the files might be placed in the Trojan’s created directories too. If the mentioned files or directories get random titles, it would be easier to identify them as suspicious, but there is a chance the malicious program could use names of Windows files, directories, etc. As you realize it is difficult to say what to expect when there could lots of personalized FormBook variants. Also, it is essential to mention the malware can continuously collect user’s information the next day since by creating some Registry entries in several Run keys, it ensures it will be able to auto-start with Windows.

Naturally, to erase FormBook manually, you would have to locate and identify all of its created files or Registry entries. Sadly, doing so might be more than challenging because we cannot list all directories where the threat could hide, and we cannot say how such directories or files on them would be titled. This is why, this time, instead of using the provided deletion instructions, it would be advisable to employ a reliable antimalware tool you trust. Just set it to scan the system, and it should find the data associated with the Trojan automatically. Later on, the user could eliminate all of it by simply pressing the removal button.

Get rid of FormBook

1. Tap Win+R.
2. Insert Regedit and click Enter.
3. Check these paths:
   HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
4. Find malicious value names created by the Trojan.
5. Right-click them one by one and press Delete.
6. Exit Registry Editor.
7. Click Win+E.
8. Check these locations:
   %PROGRAMFILES%
   %COMMONPROGRAMFILES%
   %USERPROFILE%
   %APPDATA%
   %TEMP%
9. Find malicious files created by the threat.
10. Right-click them one by one and press Delete.
11. Exit File Explorer.
12. Empty your Recycle bin.
13. Reboot the device.