Jump to content

Please help me :( Trojan:Win32/Phonzy.B!ml @MauriceNaggar

Recommended Posts

Hey guys, I wanted to convert a Video because my Editing program didn't like the format so I went to video-converterDOTcom and downloaded it in another format. According to Google the site was safe so I didn't put too much thought into it. 
Suddenly Windows Defender detected the Trojan mentioned above and I saw that "VLC player.exe" got randomly downloaded too! As far as I remember(Not 100% sure) I did not execute the File (Luckily) 

-I immediately restored my windows to a previous date
-Removed the Trojan per Windows Defender 
-Deleted all my browser cookies, logged off of everywhere etc.
-Have done every scan with Windows Defender (No new threats found)
-Have scanned with Malwarebytes (Nothing)
-Have scanned with ADWcleaner (Nothing except some stuff from HP [My PC is from HP]; should I be warry of that ?) 
-Nothing has been withdrawn from my online banking (Luckily 😀

@MauriceNaggar I would highly appreciate if you or someone else could help me out here 
I want to make sure that the Trojan is 100% gone 😅
And could the Trojan potentially come back by (for example) Hiding in Google Sync or OneDrive ? 

If I can somehow repay you guys for helping me just let me know please.

With kind regards,


Link to post
Share on other sites

Hello. :welcome: My name is Maurice. I will guide you.

  • Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

    IF Google browser is your main web browser, you should disable the SYNC feature of Google Chrome.

  • Using just the Chrome browser, signin to your Google account ( if not signed in already)  https://chrome.google.com/
    Then go to https://chrome.google.com/sync?
    Scroll down the page, press the "CLEAR DATA" button, to clear the Chrome data from your Google account.

  • Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
    1. Show-Hidden-Folders-Files-Extensions

    2. Disable-Fast-Startup

3. I would like a report set for review. This is a report only. This is the first beginning step so I can see what is what on this particular machine.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

Link to post
Share on other sites

Alright. I look forward to getting that report. {color=blue]AFTER you do that, here is next step.[/color]

This is for a scan with ESET Onlinescanner (free). ESET is a well-respected, well-known entity and tool. ESET Onlinescanner checks for viruses, other malware, adwares, & potentially unwanted applications.
This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.


  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on CUSTOM scan  and select C drive to be scanned
  • Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"
  • and click on Start scan button.

Have patience. The entire process may take an hour or more. There is an initial update download.
There is a progress window display. You may step away from machine &. Let it be. That is, once it is under way, you should leave it running. It will run for several hours.

  • At screen "Detections occurred and resolved" click on blue button "View detected results"
  • On next screen, at lower left, click on blue "Save scan log"
  • View where file is to be saved. Provide a meaningful name for the "File name:"
  • On last screen, set to Off (left) the option for Periodic scanning
  • Click "save and continue"
  • Please attach the report file so I can review
Link to post
Share on other sites

Hey Maurice, thank you for your patience!

-As of now I will not run any other scans
-Won't run ANYTHING while following your advice 
-The only "pirated" software I have is the Citra Emulator which doesn't cause such things to happen (As far as I know 😀)
-I'm logged off of Discord and the application is not running
-Opera is my main Browser and I have disabled Google Sync+Opera Sync
-Hidden Folders is enabled (See below) 
-Fast Startup is disabled (See below) 

I have one question tho: 

-Is it normal that I have so many Mcawdetections? ☠️

Your biggest fan on Earth🥇





Link to post
Share on other sites

For Your Information:

The Block notices from Malwarebytes web protection do mean that Malwarebytes is keeping your pc safe from potential harm.
A block notice is an advisory of the "block".
A "malicious website blocked" is entirely different from a "malware detected" event.

The website  Block message indicates that a potential risk was blocked by the malicious website protection.
The Malwarebytes web protection, by default, will always show each IP block occurrence.
The Malwarebytes Web-protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC.
Incoming block notice can be ignored, the Malwarebytes real-time protection is blocking the threat and there is nothing more that can be done.
On Outbound blocks, any attempted connection was stopped.
No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56).
 A browser is not required to be running, just an active Internet connection with processes running,
such as Instant messenger clients, DISCORD, or Instagram, SKYPE or Peer-to-peer software, to trigger these alerts.

These are also triggered by banner ads running on websites which is the most common form of alert.

Link to post
Share on other sites

Yes, do go ahead with the ESET Online. That is going to run several hours. Once started and it is on the way, moving, then leave it alone. Overall the reposts collected show a normal system. Once after ESET is done, I will have another suggestion for your machine.

Link to post
Share on other sites

  • 4 weeks later...
  • Root Admin

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection



Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.