How to remove “Trojan:Win32/Phonzy.B!ml”?

The Trojan:Win32/Phonzy.B!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Phonzy.B!ml virus can do?

Authenticode signature is invalid

How to determine Trojan:Win32/Phonzy.B!ml?


File Info:
name: D713A41BB6221E4FEE24.mlw
path: /opt/CAPEv2/storage/binaries/cfe0524e9d5117d27220fb11c64ef6fe97a5b5b854dd79bcc4e2ec4bf2fd139d
crc32: 8AC10913
md5: d713a41bb6221e4fee244ca7dbe9beb1
sha1: 68919e9808c47e03fca487953691b9da8fd94842
sha256: cfe0524e9d5117d27220fb11c64ef6fe97a5b5b854dd79bcc4e2ec4bf2fd139d
sha512: d4c499ee9c44e17ce10de0bf569469c06188b531933ea0774a22c63f79b044c1cea4c3e5a928155ecde67f83af830e34078dd5bb2bff88bee033c5897722f656
ssdeep: 12288:vuGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Zt/sBlDqgZQd6XKtiMJYiPU
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1CA65232F28C7D466E7BF4A722D643400A1BB3658EE99709BE3D1745D2E3C4138D78A63
sha3_384: 27ea0dbf7333bba74d61e217d04934a64c056a6328924fb7e62baedab63611c98f0d88214e4138559d83271b2e2b2f40
ep_bytes: e812030000e99efdffff558bec81ec28
timestamp: 2006-10-27 06:43:33

Version Info:
CompanyName: Microsoft Corporation
FileDescription: GrooveClean Utility
FileVersion: 12.0.4518.1014
InternalName: GrooveClean
LegalCopyright: © 2006 Microsoft Corporation.  All rights reserved.
OriginalFilename: GrooveClean.exe
ProductName: GrooveClean Utility
ProductVersion: 4.2.0.2623
SpecialBuild: 
Translation: 0x0000 0x04b0

Trojan:Win32/Phonzy.B!ml also known as:

Bkav	W32.AIDetectMalware
Lionic	Virus.Win32.Expiro.n!c
Elastic	malicious (high confidence)
DrWeb	Win32.Expiro.158
MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Generic.mg.d713a41bb6221e4f
CAT-QuickHeal	W32.Expiro.R3
Skyhigh	BehavesLike.Win32.Generic.tt
Malwarebytes	Virus.M0yv
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Virus ( 005a8b911 )
Alibaba	Virus:Win32/Moiva.cde749ef
K7GW	Virus ( 005a8b911 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	W32.Xpiro.J!dam
ESET-NOD32	a variant of Win32/Expiro.NDP
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Expiro-9941636-0
Kaspersky	Virus.Win32.Moiva.a
BitDefender	Win32.Expiro.Gen.7
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Vitro [Inf]
Tencent	Virus.Win32.VirMoiva.a
Emsisoft	Win32.Expiro.Gen.7 (B)
F-Secure	Malware.W32/Infector.Gen
VIPRE	Win32.Expiro.Gen.7
TrendMicro	Virus.Win32.EXPIRO.JMA
Sophos	W32/Moiva-A
Ikarus	Trojan.Patched
Varist	W32/Expiro.AU.gen!Eldorado
Avira	W32/Infector.Gen
Antiy-AVL	Virus/Win32.Expiro.x
Kingsoft	malware.kb.a.925
Microsoft	Trojan:Win32/Phonzy.B!ml
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Win32.Expiro.Gen.7
ZoneAlarm	Virus.Win32.Moiva.a
GData	Win32.Expiro.Gen.7
Google	Detected
Acronis	suspicious
VBA32	Trojan.Sabsik.TE
ALYac	Win32.Expiro.Gen.7
MAX	malware (ai score=81)
Cylance	unsafe
Panda	W32/Moyv.A
Rising	Virus.Moiva!8.143D0 (CLOUD)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Expiro.NDP!tr
AVG	Win32:Vitro [Inf]
Cybereason	malicious.808c47
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Phonzy.B!ml?

Trojan:Win32/Phonzy.B!ml removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X