Do we have any hashes of the purported fake versions they pushed before they realised something was wrong? I'm not saying they did, or didn't, but I have auto-updates disabled on my mining rig and haven't updated in a month, and on my PC I use Excavator because it has no fee and I have an nVidia card while my rig is all AMD cards. So I went ahead and checked my PhoenixMiner version and all the hashes checked out. What exactly was the malware version?