How to remove “Trojan:Win32/Phonzy.A!ml”?

The Trojan:Win32/Phonzy.A!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.A!ml virus can do?

Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Phonzy.A!ml?


File Info:
name: 0DB74BBB21850822DB9D.mlw
path: /opt/CAPEv2/storage/binaries/fee38a838dc6bb1582c7317a6841dd064bc779922e4ddc56f3448befca499a8b
crc32: EC2BE676
md5: 0db74bbb21850822db9dfcffbfe42e94
sha1: 8691fca129c0eeda02ba9463d2dc6602a3215793
sha256: fee38a838dc6bb1582c7317a6841dd064bc779922e4ddc56f3448befca499a8b
sha512: 8ccba949ea6e3749c8c53c0f9b02d88eed5ce33ee5686e2f25bf5cdbc004b7bcc30d6aa68b692dc4e32b11044b8125c68e924f9107b1c2842c2164133275cfb6
ssdeep: 12288:BYWmGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:BYot/sBlDqgZQd6XKtiMJYiPU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T189751207F6C3D039F8B319B21F795415A42AFE74AB49A0DBA2C6694E1DB80D26D34337
sha3_384: a4b5dbe0f39e0f0790af7f1b2253c14e45c8e0a176387b279f46b1f8c98a58f100b82fbf354508f9dce1e6c1f1880f64
ep_bytes: e8d3030000e937fdffffcccc68d57b40
timestamp: 2014-11-20 18:03:43

Version Info:
CompanyName: Adobe Systems Incorporated
FileDescription: Adobe Acrobat Update Service
FileVersion: 1.801.10.4720
InternalName: armsvc.exe
LegalCopyright: Copyright © 2013 Adobe Systems Incorporated.  All rights reserved.
OriginalFilename: armsvc.exe
ProductName: Adobe Acrobat Update Service
ProductVersion: 1.801.10.4720
Translation: 0x0409 0x04b0

Trojan:Win32/Phonzy.A!ml also known as:

Bkav	W32.Common.113A307F
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.70823919
FireEye	Trojan.GenericKD.70823919
Skyhigh	BehavesLike.Win32.Generic.tt
McAfee	Artemis!0DB74BBB2185
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Cynet	Malicious (score: 100)
BitDefender	Trojan.GenericKD.70823919
Emsisoft	Trojan.GenericKD.70823919 (B)
VIPRE	Trojan.GenericKD.70823919
Sophos	ML/PE-A
Ikarus	Virus.Win32.Expiro
GData	Trojan.GenericKD.70823919
Google	Detected
Arcabit	Trojan.Generic.D438AFEF
ViRobot	Trojan.Win.Z.Agent.1566720.F
Microsoft	Trojan:Win32/Phonzy.A!ml
Varist	W32/Floxif.H.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C5464739
ALYac	Trojan.GenericKD.70823919
MAX	malware (ai score=81)
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_GEN.R002H09LM23
MaxSecure	Trojan.Malware.221338873.susgen
Fortinet	W32/PossibleThreat
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Trojan:Win32/Phonzy.A!ml?

Trojan:Win32/Phonzy.A!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X