12,194guides5,441members
8 Octporterneuman.mx: PowerShell and JavaScript files tied to the AveMaria remote access trojan, and what to do8 Octdonutclientsmods.xyz: fake DonutSMP Minecraft mods tagged SilentNet, and what to do if you ran one8 Octsqpengg.com: a server handing out crypted PowerShell scripts, and what to do if one ran on your PC8 Octdonutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one8 Octmaciejbi.hosting24.pl: a hosting subdomain that served Remcos scripts and a stego picture, and what to do if your PC fetched them8 Oct87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran8 Octficus.in: picture files hiding the Remcos remote access trojan, and what to do if a script fetched them8 OctOpenDrive virus: why web.opendrive.com shows up in malware alerts, and what to do if a file from it installed Remcos
Topic · 8 pages

FormBook stealer

FormBook stealer: every 2-Spyware guide, news story and file page on this topic, newest first.

Dalintis
FacebookXLinkedInTelegramWhatsAppEl. paštuKopijuoti nuorodą

Latest: 87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran (10/8/2026)

Newest first

Pages about FormBook stealer

TrojansHigh risk

Remove 87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran

87130921-60-20220830152356.webstarterz.com is a subdomain that URLhaus lists six times in September and October 2026 for PowerShell scripts (crypted.ps1, secured_stub.ps1) and a…Ugnius Kiguolis ·
TrojansHigh risk

Remove www.tmcksa.com: a hacked site serving a PowerShell stub for the Formbook stealer, and what to do if your PC ran it

www.tmcksa.com is a website registered in 2013 that URLhaus listed three times on 5 October 2026 for a PowerShell script, secured_stub.ps1, tagged Formbook. Formbook is a Windows…Ugnius Kiguolis ·
TrojansHigh risk

Remove www.beinke-aufzuege.de: a hacked website hosting FormBook PowerShell stubs, and what to do if a script fetched them

www.beinke-aufzuege.de is the address of a German website that URLhaus lists for four PowerShell files tagged Formbook, a password stealer for Windows, hidden in random folders…Ugnius Kiguolis ·
MalwareHigh risk

Remove FormBook virus

Lucia Danes ·
MalwareHigh risk

Remove Facebook Message virus

Lucia Danes ·
MalwareHigh risk

Remove Win32:DangerousSig

Gabriel E. Hall ·
MalwareHigh risk

Remove COVID-19 Pandemic email virus

Olivia Morelli ·
MalwareHigh risk

Remove GuLoader

GuLoader is a malware downloader associated with infiltration of Remote Access Trojans like Remcos GuLoader is a type of malware that is used by the attackers to download and…Ugnius Kiguolis ·

A topic collects every page that is about it; the list updates when new pages are published.

5,441 members already hereReading, writing, commenting and voting. 0 verified · 166 joined this year
All membersJoin