Recurring Trojan.Egguard.PrxysvrRST on reboot windows 10

[Sneha]

My system has a few trojans which re appear on every reboot. Even when i remove them using malwarebyte, they come up again in the next scan. the name is Trojan.Egguard.PrxysvrRST. Please help me remove it.

malwarebyte report.txt

[Sneha]

My system has a few trojans which re appear on every reboot. Even when i remove them using malwarebyte, they come up again in the next scan. the name is Trojan.Egguard.PrxysvrRST. Please help me remove it.

log.txt

malwarebyte report.txt

Edited August 22, 2017 by Sneha

[AdvancedSetup]

Hello @Sneha and

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Sneha]

Hello,

Please find files attached. Before your reply, i used cc cleaner, which cleaned most of the residual malware files i guess.

 

 

AdwCleaner[C0].txt

AdwCleaner[S0].txt

Addition_22-08-2017 14.25.22.txt

FRST_22-08-2017 14.25.23.txt

malwarebyte report.txt

[AdvancedSetup]

Unless you're programming in Java and require these builds of Java, then I would highly recommend that you uninstall these versions of Java. The older versions of Java have been compromised and can help lead to infections on your computer.

Java SE Development Kit 7 Update 79 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170790}) (Version: 1.7.0.790 - Oracle)
Java SE Development Kit 8 Update 91 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180910}) (Version: 8.0.910.15 - Oracle Corporation)

Please read the following article concerning the use of MSCONFIG
Msconfig Is Not A Startup Manager
 

 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

 

[Sneha]

Hello,

Please find the fixlog attached.

Uninstalled the java development kits.

I am unable to change msconfig to "Normal Startup". As soon as I select that and press apply, it comes  back to selective startup. Even after restarting it doesn't change. How do I change that? 

 

Fixlog.txt

[AdvancedSetup]

Please download this new fixlist file and run it.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

 

Once it reboots then run a NEW full FRST scan and make sure you place a check mark in the Additions.txt checkbox and post back all 3 new logs.

I'm heading out but will check your logs sometime tomorrow.

Thank you

Ron

 

[Sneha]

msconfig still wont set to normal. Its set to selective and if i select normal, the apply button is disabled. check attachments

Addition.txt

Fixlog.txt

FRST.txt

[AdvancedSetup]

All items for MSCONFIG were removed but looks like these 3 were set/reset again.

HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKU\S-1-5-21-3975546490-885952179-1219423800-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-3975546490-885952179-1219423800-1001\...\StartupApproved\Run: => "OneDrive"

If you look for those items on the Startup tab you should be able to change them to get it back to NORMAL

 

Aside from the MSCONFIG item, how is the computer running now?

Are there still any signs of an infection?

Please run a new Threat Scan with Malwarebytes and post back that log. Also, if you want, we have updated to version 3.2

 

Thanks

Ron

 

[Sneha]

Hi,

I installed the new version and ran a scan.

System looks clean.

I had network connectivity issues intermittently, but i'm hoping that was my ISP!

msconfig is still not fixed. I don't know how/where these three entries are coming from. I don't even have these applications installed in my system. At least none that i installed on purpose.
Please find attached files.
 

 

malwarebyte report.txt

[AdvancedSetup]

I wouldn't worry about the MSCONFIG - it's more of a recommendation than a threat or broken system.

As the logs otherwise look clean, you should be good now.

Is there anything else I can assist you with?

Thank you

Ron

 

[Sneha]

Alright!

No, Thanks a lot for your help

[AdvancedSetup]

You're quite welcome. I'll go ahead then and close your topic.

Take care and stay safe out there.

Don't forget to backup your data

Backup Software

Thank you again

Ron

 

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!