Should I remove “Backdoor.Phantom.2.0”?

The Backdoor.Phantom.2.0 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.Phantom.2.0 virus can do?

Creates RWX memory
Starts servers listening on 0.0.0.0:2177
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian

How to determine Backdoor.Phantom.2.0?


File Info:
crc32: AC9CB743
md5: 21730a01e5a5c8edcd20133c1bd3a15a
name: PFS.EXE
sha1: f6d3c3766705d01774ea885477c393709cfe3206
sha256: ef104bc5b1d26269156d07f4c19718ec5a5541bd95ef97881b981dfa4dd1ca70
sha512: 3cf3cb7d664c15f13353f2beeb562d0732c626a8a47b3e365d1703e3f39b91af9cdcae204f107af37e3ba428cecc116058b0750b9e1cfc79ed03a97ca2b89f03
ssdeep: 12288:u8Wd94qe3zuC/TqSuWH3A0NiKnVMFGjTXUUGBtU//Q:uHje5tTwGPXUfT
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Frivare
InternalName: 
FileVersion: 2.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: PhantomFTPServer
ProductVersion: 2.0.0.0
FileDescription: 
OriginalFilename: 
Translation: 0x0419 0x04e3

Backdoor.Phantom.2.0 also known as:

MicroWorld-eScan	Backdoor.Phantom.2.0
FireEye	Backdoor.Phantom.2.0
McAfee	Artemis!21730A01E5A5
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic.pak!cobra
Sangfor	Malware
K7AntiVirus	Trojan ( 7000000f1 )
BitDefender	Backdoor.Phantom.2.0
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.1e5a5c
TrendMicro	BKDR_PHANTOM.20
BitDefenderTheta	Gen:NN.ZelphiF.33564.PG0@ay86Nomc
F-Prot	W32/Malware!7bfe
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Phantom.20.B
TrendMicro-HouseCall	BKDR_PHANTOM.20
Avast	Win32:Trojan-gen
GData	Backdoor.Phantom.2.0
Kaspersky	Backdoor.Win32.Phantom.20.b
Alibaba	Backdoor:Win32/Phantom.1bcf8e91
NANO-Antivirus	Trojan.Win32.Phantom-20.fwqt
ViRobot	Backdoor.Win32.Phantom_20.Svr.B
AegisLab	Trojan.Win32.Phantom.m!c
Rising	Trojan.Phantom.20.b (CLOUD)
Emsisoft	Backdoor.Phantom.2.0 (B)
Comodo	Backdoor.Win32.Phantom.20.B@2f3r
F-Secure	Backdoor.BDS/Phantom.20.Srv
DrWeb	BackDoor.Phantom.20
Zillya	Backdoor.Phantom.Win32.1
McAfee-GW-Edition	Artemis!Trojan
CMC	Generic.Win32.21730a01e5!MD
Sophos	Troj/Phantom-10
Cyren	W32/Risk.ELAC-7048
Jiangmin	Backdoor/Phantom.20.b
Webroot	W32.Trojan.Trojan-Backdoor.Gen.
Avira	BDS/Phantom.20.Srv
Antiy-AVL	Trojan[Backdoor]/Win32.Phantom
Microsoft	Backdoor:Win32/Phantom.2_0
Arcabit	Backdoor.Phantom.2.0
AhnLab-V3	Trojan/Win32.Phantom.R99336
ZoneAlarm	Backdoor.Win32.Phantom.20.b
TACHYON	Backdoor/W32.DP-Phantom.686080
VBA32	Backdoor.Phantom.2_0.b
ALYac	Backdoor.Phantom.2.0
MAX	malware (ai score=100)
Ad-Aware	Backdoor.Phantom.2.0
Panda	Bck/Phantom.10
Tencent	Win32.Backdoor.Phantom.Hoyd
Yandex	Backdoor.Phantom.A
Ikarus	Backdoor.Win32.Nerte
eGambit	Trojan.Generic
Fortinet	W32/Phantom.10!tr.bdr
AVG	Win32:Trojan-gen
Qihoo-360	Win32/Backdoor.b75

How to remove Backdoor.Phantom.2.0?

Backdoor.Phantom.2.0 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X