How to remove XLoader malware

What is XLoader malware

XLoader is a rebranded version of FormBook, a well-known information-stealing malware that was sold as a malware-as-a-service (MaaS) platform until 2018. It is capable of stealing passwords from web browsers, email clients, and FTP clients, taking screenshots, logging keystrokes, and executing additional files or commands. To remove XLoader from an infected system, it is recommended to use reputable anti-malware software that can detect and eliminate the threat. Users should perform a full system scan and follow the software’s instructions to quarantine and remove any detected malware components. For macOS users, it is advised to check the Autorun and LaunchAgents folders for suspicious entries and remove them if necessary. Additionally, users should be cautious when granting permissions to applications and avoid downloading software from unverified sites. XLoader is a sophisticated and stealthy malware that poses a significant threat to both Windows and macOS users. By staying informed about the latest cybersecurity trends and practicing good security habits, users can minimize the risk of infection and protect their sensitive data from cybercriminals.

XLoader malware (Windows)

XLoader malware (MacOS)

How XLoader malware infected your system

XLoader typically spreads via phishing emails containing malicious Microsoft Office documents or PDF files. When these files are opened, they download and execute the XLoader payload from a remote server. The payload then installs itself as a persistent service on the device and starts communicating with a command-and-control (C2) server. For macOS, XLoader has been observed infiltrating systems under the guise of an office productivity application, potentially targeting sensitive information related to working environments. The malware arrives bundled within an Apple Disk Image file titled “OfficeNote.dmg” and can launch automatically after installation.

1. Download XLoader malware Removal Tool
2. Use Windows Malicious Software Removal Tool to remove XLoader malware
3. Use Autoruns to remove XLoader malware
4. Files, folders and registry keys of XLoader malware
5. Other aliases of XLoader malware
6. How to protect from threats, like XLoader malware

Remove XLoader malware manually

Manual removal of XLoader malware by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove XLoader malware using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove XLoader malware using Autoruns

XLoader malware often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder and registry keys of XLoader malware

XLoader malware files and folders


{randomname}.exe


XLoader malware registry keys


no information


Aliases of XLoader malware

How to protect from threats, like XLoader malware, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove XLoader malware. However, if you got infected with XLoader malware with existing and updated security software, you may consider changing it. To feel safe and protect your PC from XLoader malware on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below: