fight against phishing malwares may be exist on client PC
Fundamentally this is impossible. If the client machine is compromised at a point where code can be run either as root or the user you intend to access your application then you should assume a determined enough actor will be able to read anything your application can.
making user data untraceable - preventing anybody to know what data belong to what person.
Then how will your application know which data to give to the user? You can have users sign in with an alias - but that is the case with any username / password system that does not verify the users identity.
Is AES good for encrypting files or could you suggest me better?
AES-256 (in the correct modes for the usage) is viewed as secure. "More Secure" and "Less Secure" aren't really a thing. Either something is viewed as "unlikely to be breakable any time soon with expected technology progression" or not.
But you also need to decide where you will encrypt this data (client or server), where you will store the keys for the encryption and whether you will encrypt communication with the server. What is the communication system between the client and server? You almost certainly want to use some form of SSL.
If data is encrypted with user provided keys or passwords (assuming you do not store these) then it will be entirely unrecoverable should they forget their password. If you use server stored then should your server architecture become compromised it is likely they will get the keys as well as the data and be able to recover it.
I would suggest you need substantially more reading / learning until you fully understand these topics and the respective consequences in decisions before you proceed further.