Trojan Egguard PrxySvrRST

[Miriam]

So I was surfing the net and downloaded an iso mounting software which happened to have just one setup file, After I executed it a window not typical of an installation program opened which had about three buttons. After that a bunch of CMD windows opened and I powered off my modem right away and ran malwarebytes along with adw cleaner and hitman pro.

 

That seems to have taken care of most of all pups and trojans as well as the fishy processes and registry keys. The problem is that a single trojan egguard resgistry key keeps coming up each time I boot up my pc and run malwarebytes and it's called Egguard PrxySvrRST which it seems no matter what I do I can't get rid of it.

egguard.txt

[kevinf80]

Hello Miriam and welcome to Malwarebytes,

Follow the instructions at this link and post the requested logs:  https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Thank you,

Kevin

 

[Miriam]

Got it, I'm following the instructions now.

[Miriam]

 

9 minutes ago, kevinf80 said:

Hello Miriam and welcome to Malwarebytes,

Follow the instructions at this link and post the requested logs:  https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Thank you,

Kevin

 

Here are the requested logs.

Addition.txt

FRST.txt

[kevinf80]

Why are you running in safe mode...?

[Miriam]

11 minutes ago, kevinf80 said:

Why are you running in safe mode...?

I was trying to remove the egguard virus with malwarebytes anti rootkit tool, now it seems I have gotten rid of the persistent registry key.

 

Malwarebytes no longer shows the egguard registry key virus, adw cleaner and hitman pro show nothing anymore as well.

[kevinf80]

You can complete the following in safemode with NW....

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Boot back to normal mode, continue: Please open Malwarebytes Anti-Malware.   On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. When the Scan is complete Apply Actions to any found entries. Wait for the prompt to restart the computer to appear (if applicable), then click on Yes. After the restart once you are back at your desktop, open MBAM once more. To get the log from Malwarebytes do the following:   Click on the History tab > Application Logs. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Double click on Adwcleaner.exe to run the tool Click on the Scan in the Actions box Please wait fot the scan to finish.. When "Waiting for action.Please uncheck elements you want to keep" shows in top line.. Click on the Cleaning box. Next click OK on the "Closing Programs" pop up box. Click OK on the Information box & again OK to allow the necessary reboot After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed... Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system.... 32 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en 64 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Post those logs, also let me know if there are any remaining issues or concerns.... THank you, Kevin.

fixlist.txt

[Miriam]

Thanks for the instructions, I'll do those in the morning as it's late night around here. I'll post the logs as soon as I'm done tomorrow.

[kevinf80]

Hiya Miriam,

Ok will catch up later, i`m in the UK so we are right out of sync time wise...

Regards,

Kevin..

[Miriam]

Finally had time to do all the scans and steps in the instructions, Here are the requested logs.

AdwCleaner[S8].txt

Fixlog.txt

MBAM Scan.txt

mrt.log

[Miriam]

6 hours ago, kevinf80 said:

Hiya Miriam,

Ok will catch up later, i`m in the UK so we are right out of sync time wise...

Regards,

Kevin..

Forgot to quote in my reply, Sorry for the double post as I couldn't figure another way to notify you without sending a PM.

[kevinf80]

How is your system responding now, do you have any remaining issues or concerns...?

[Miriam]

2 minutes ago, kevinf80 said:

How is your system responding now, do you have any remaining issues or concerns...?

So far I no longer get any automatic opening of CMD windows, Malwarebytes along with ADW cleaner and hitam pro as well as windows malicious software removal tool show nothing anymore. I have done more scans now including rootkits and nothig pops up.

I watched the process names and inspected the "C:" drive and found no suspicious folders or anything, So far it's responding good. My only real concern apart from the egguard persistent registry key was something that looked like a miner in the processess list called "zminer" but has been removed in the process of the instructions I followed.

If anything else comes up within the week I'll post here again, Thanks a lot for the help!

[kevinf80]

Yes all remaining parts of the infection were shifted with FRST fix, other scans were to mop up any possible remnants, unless you have any other issues run the following to clean up:

Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!