Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Rootkit + Trj in bootx64/efigard


  • Please log in to reply
No replies to this topic

#1 raee

raee

  •  Avatar image
  • Members
  • 1 posts
  • ONLINE
  •  
  • Local time:03:42 AM

Posted Today, 02:33 AM

I believe this likely stemmed from a faulty "McAfee" download/key from a best friend years ago because....THAT obviously never picked any of this up.

I switched to norton a few months ago and hesitated to even address this at first, due to doing some digging and many people saying they get repeated false positives (also, a regular quick scan initially removed the trojans according to norton). However, after looking back into it and doing a few more full scans and noticing that not only the Rootkits in both the bootx64.efi & EfiGardDxe.efi files still remained, the trojans kept reappearing with their "on pc from" date the same as the first time: 2021. There is an "Unknown" for the rootkits. clean reinstalls have obviously not done a thing.

But when I scan on malwarebytes and trial eset no problems are detected. I'm wondering if norton is just that screwy (I do plan on switching antivirus after this whole ordeal either way) or something is seriously going on because if they are trying to scare me it worked!

 

Norton tells me the following:

 

for the bootx64 trojan:

Win64:EfiGard-A [Trj]

on pc from: 8/17/21 10:02 pm

 

for efigard:

Win64:EfGard-B [Trj]

on pc from: 9/1/21

 

for the rootkit, it just says for both that it is a Rootkit. everything else unknown.

 

I have provided my FRST logs below. any help provided would be much appreciated!

 

UPDATE 3:08AM ESET after switching to secure boot (I guess it is as bad as I thought!):

A threat (EFI/Riskware.EfiGuard.D) was found in your computer's firmware.

This type of detection cannot be automatically removed and may require the use of special tools depending on the hardware.

 

\Device\HarddiskVolume1\EFI\Boot\EfiGuardDxe.efi

 

Startup scanner;file;\Device\HarddiskVolume1\EFI\Boot\EfiGuardDxe.efi;a variant of EFI/Riskware.EfiGuard.D application;;;;E920E40CFC0C6A805D657C8F23F9C0612CD39F59;9/1/2021 8:29:36 PM

Attached Files


Edited by raee, Today, 03:16 AM.


BC AdBot (Login to Remove)

 





5 user(s) are reading this topic

1 members, 4 guests, 0 anonymous users


    raee