Your Cheque Is Ready Email Virus: How the FormBook Malspam Attack Infects Windows

An unexpected accountant says your cheque is ready and shows a convincing bank-cheque image. The image is not proof of payment, and it is not a normal attachment.

In this malspam campaign, clicking the cheque downloads a ZIP archive. Running the JavaScript file inside can install FormBook, a password-stealing Windows trojan that watches what you type and what appears on screen.

Your Cheque Is Ready Email Virus Overview

The “Your Cheque Is Ready” message impersonates an accountant at a UAE-based air-conditioning company and claims that an original cheque will be delivered shortly. It says a copy is attached “for your reference,” but the visible cheque is actually a clickable image. That distinction matters because the click does not simply enlarge a document; it initiates a download.

The downloaded file is a compressed ZIP archive containing JavaScript. Windows users may see the script with a document-like icon or a shortened filename if known file extensions are hidden. Double-clicking it allows Windows Script Host to execute code, which starts the malware installation. The cheque, company details, address, and telephone numbers are props used to make the payment story feel routine.

The delivered threat is FormBook, an information-stealing trojan sold to cybercriminals as an easy-to-use service. FormBook can capture keystrokes, collect text copied to the clipboard, take screenshots, and steal credentials submitted through web forms. That combination exposes email logins, workplace portals, online banking, shopping accounts, social media, and any sensitive conversation typed while the malware is active.

FormBook can also receive commands from its operator and download more files. A victim may therefore face more than the initial data theft: the infected PC can be used to install additional stealers, remote-access tools, ransomware, or botnet components. Visible symptoms may be minimal because the purpose is to remain useful long enough to collect valuable information.

Simply receiving or reading the email does not infect the computer. The high-risk sequence is clicking the embedded cheque, downloading the archive, extracting it, and running the JavaScript file. Anyone who completed those steps should disconnect the PC and treat every password or financial session used afterward as potentially exposed.

How the Your Cheque Is Ready Malware Attack Works

Step 1: A payment-themed email reaches the inbox

The subject references a cheque and the sender uses an accountant’s title, company signature, physical address, and regional telephone numbers. Business recipients may assume that the message concerns a customer refund, supplier payment, or outstanding invoice.

The email is unsolicited and often lacks a verifiable transaction reference. The named bank and businesses are not responsible for the campaign; criminals are borrowing familiar payment language and company details.

Step 2: The cheque image acts as a disguised download link

The message says the cheque copy is attached, but the visible image behaves like a link. A normal preview should not require a separate archive or script. Hovering over the image may reveal an unrelated download address.

This trick exploits a common habit: people click images without examining them as carefully as a button labeled “Download.”

Step 3: A ZIP archive arrives on the PC

The archive creates another layer between the email and the dangerous file. Compression can help the payload pass through weaker mail filters and makes the download resemble a packaged business document.

Opening a ZIP is not automatically the same as running malware, but extracting and launching its contents creates the next opportunity for infection.

Step 4: The JavaScript file executes through Windows Script Host

The script may appear safer than an EXE, particularly when Windows hides its .js extension. Once executed, it can contact remote infrastructure and retrieve or launch the FormBook payload.

A cheque copy should be an image or PDF. It should never require JavaScript, PowerShell, a command prompt, macros, or an installer.

Step 5: FormBook captures credentials and activity

After installation, FormBook records information the victim enters, data copied through the clipboard, and screenshots of active windows. Credentials typed into websites can be stolen even when the website itself is legitimate and protected by HTTPS.

The operator can combine usernames, passwords, screenshots, and clipboard contents to understand which accounts are valuable and how the victim uses them.

Step 6: Stolen data is sent out and more malware may follow

Collected information is transmitted to criminal-controlled servers. Commands can instruct the infection to download and run additional files, allowing the incident to expand after the original script disappears.

Uninstalling an email client or deleting the downloaded ZIP does not remove FormBook once the payload has executed.

What FormBook Can Steal

• Passwords and other information entered into web forms.
• Keystrokes typed into browsers, email clients, chats, and business software.
• Clipboard contents, including copied passwords, payment details, and crypto addresses.
• Screenshots of account dashboards, documents, and private conversations.
• System information that helps attackers profile the device.
• Access for additional malware downloaded on command.

What to Do If You Opened the ZIP or JavaScript File

1. Disconnect the PC from the network. Turn off Wi-Fi and unplug Ethernet to interrupt data theft and follow-on downloads.
2. Do not log into accounts from the exposed computer. Use a clean phone or PC for urgent password changes and bank checks.
3. Run the full Windows malware-removal sequence below. Use complete scans, not only a quick scan, and allow quarantining tools to restart Windows when required.
4. Change high-value passwords after cleanup. Start with primary email, password manager, banking, workplace accounts, cloud storage, and social media. Replace reused passwords everywhere.
5. Revoke active sessions and enable multi-factor authentication. Stolen cookies or tokens may remain useful even after a password change.
6. Check financial and business activity. Review transfers, payees, invoice changes, mailbox forwarding rules, and messages sent from your account.
7. Notify workplace IT if applicable. A business inbox or company PC can expose colleagues, customer data, shared drives, and internal payment processes.

How to Check a Payment Email Without Triggering the Payload

Start outside the message. Look up the alleged sender using records your company already holds and call a known telephone number. Ask for the cheque number, invoice reference, amount, and delivery details. Do not reply to the suspicious thread because a forged sender or lookalike address can keep the conversation inside the attacker’s channel.

Hover over images and buttons without clicking. A cheque preview should not point to a file-sharing domain, script, shortened URL, or unrelated website. If the email supposedly comes from an accounting system, sign in to that system through a trusted bookmark and check whether the document appears there.

Display full filename extensions in Windows before opening downloaded files. A payment document may reasonably be a PDF or image, but .js, .jse, .vbs, .scr, .exe, .lnk, and .cmd files can execute code. A double extension such as cheque.pdf.js is a strong danger sign.

Businesses should route unexpected payment attachments through an approved security or accounts-payable review process. Staff should be able to report a suspicious message without being blamed for delaying a payment. A five-minute independent confirmation is far cheaper than a credential theft incident.

Possible Signs of a FormBook Infection

FormBook is built to remain quiet, so a lack of pop-ups does not prove that Windows is clean. Investigate unexpected script-host activity, security alerts related to a JavaScript file, unexplained outbound connections, disabled protection, or account logins from unfamiliar locations.

Also watch for messages sent from your accounts, new mailbox rules, changed recovery settings, or fraudulent transactions shortly after the file ran. These signs can appear after the original email and archive have already been deleted.

Frequently Asked Questions

Am I infected if I only read the email?

No. Reading the message does not install FormBook. If you clicked the cheque but did not run the downloaded script, delete the files and scan the computer as a precaution. Execution of the JavaScript file is the critical step.

Can deleting the ZIP remove FormBook?

No. Deleting the delivery archive removes only the copy you downloaded. If the script ran, the payload may already be installed elsewhere and may have created persistence.

The Bottom Line

The “Your Cheque Is Ready” email is not a payment notice. It is a malware-delivery campaign that hides a ZIP and JavaScript infection chain behind a clickable cheque image.

If you ran the script, assume FormBook may have captured passwords, keystrokes, clipboard data, and screenshots. Disconnect the PC, complete the removal guide, and secure accounts from a clean device.

If you suspect your computer is infected with malware — slow performance, pop-ups, redirects, or programs you don’t recognize — follow the free step-by-step removal guide below to clean it completely.

Remove Malware from Windows [Step-by-Step Guide]

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Rkill to terminate suspicious programs
• STEP 4: Use Malwarebytes to remove Trojans and unwanted programs
• STEP 5: Use HitmanPro to remove rootkits and other malware
• STEP 6: Use AdwCleaner to remove malicious browser policies and adware
• STEP 7: Perform a final check with ESET Online Scanner

STEP 1: Uninstall malicious programs from Windows

First, we’ll manually check your computer for unknown or malicious programs. Adware and browser hijackers often have a working uninstall entry — removing them this way takes care of the easy part before we run the scanners.

With the malicious programs removed, you’re ready for the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Rkill to terminate suspicious programs

Next, we’ll download and run Rkill to stop any suspicious processes running in the background. This prevents the malware from interfering with the removal tools in the following steps.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 4: Use Malwarebytes to remove Trojans and unwanted programs

Now we’ll install Malwarebytes and run a full scan to detect and remove infections, adware, and potentially unwanted programs from your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 5: Use HitmanPro to remove rootkits and other malware

Next, we’ll run a second-opinion scan with HitmanPro to catch Trojans, rootkits, and other malicious programs that may have survived the previous step.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 6: Use AdwCleaner to remove malicious browser policies and adware

We’ll now use AdwCleaner to remove malicious browser policies and unwanted browser extensions — the leftovers that keep hijacking your browser settings even after the malware itself is gone.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 7: Perform a final check with ESET Online Scanner

Finally, we’ll run ESET Online Scanner as a last sweep to confirm nothing was missed. If this scan comes back clean, your computer is malware-free.

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

That’s it — your Windows computer is now clean. The Trojans, adware, and any other malware have been removed.

If your current antivirus allowed this malicious program on your computer, you may want to consider purchasing Malwarebytes Premium to protect against these types of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:

• Run a computer scan with ESET Online Scanner
• Ask for help in our Windows Malware Removal Help & Support forum.