I believe this likely stemmed from a faulty "McAfee" download/key from a best friend years ago because....THAT obviously never picked any of this up.
I switched to norton a few months ago and hesitated to even address this at first, due to doing some digging and many people saying they get repeated false positives (also, a regular quick scan initially removed the trojans according to norton). However, after looking back into it and doing a few more full scans and noticing that not only the Rootkits in both the bootx64.efi & EfiGardDxe.efi files still remained, the trojans kept reappearing with their "on pc from" date the same as the first time: 2021. There is an "Unknown" for the rootkits. clean reinstalls have obviously not done a thing.
But when I scan on malwarebytes and trial eset no problems are detected. I'm wondering if norton is just that screwy (I do plan on switching antivirus after this whole ordeal either way) or something is seriously going on because if they are trying to scare me it worked!
Norton tells me the following:
for the bootx64 trojan:
Win64:EfiGard-A [Trj]
on pc from: 8/17/21 10:02 pm
for efigard:
Win64:EfGard-B [Trj]
on pc from: 9/1/21
for the rootkit, it just says for both that it is a Rootkit. everything else unknown.
I have provided my FRST logs below. any help provided would be much appreciated!
UPDATE 3:08AM ESET after switching to secure boot (I guess it is as bad as I thought!):
A threat (EFI/Riskware.EfiGuard.D) was found in your computer's firmware.
This type of detection cannot be automatically removed and may require the use of special tools depending on the hardware.
\Device\HarddiskVolume1\EFI\Boot\EfiGuardDxe.efi
Startup scanner;file;\Device\HarddiskVolume1\EFI\Boot\EfiGuardDxe.efi;a variant of EFI/Riskware.EfiGuard.D application;;;;E920E40CFC0C6A805D657C8F23F9C0612CD39F59;9/1/2021 8:29:36 PM
Attached Files
Edited by raee, Today, 03:16 AM.