PowerShell/TrojanDownloader.Agent.EQN trojan

[teilow 0]

Hello there,

I have several Windows Servers that consistently detect PowerShell/TrojanDownloader.Agent.EQN trojan.

I can't determine which file is impacted by this attack. Every time EFSW shows cleaned by blocking, but the same log appears again after a few hours. How to solve this problem?

eis_logs.zip

[Marcos 5,070]

Please run Task Scheduler and delete the tasks:

ViGEmBusUpdater1
MSI Task Host - Detect_Monitor

Also I'd recommend enabling:

• Detection of potentially unsafe applications
• LiveGrid - feedback system

Note: It is possible that the tasks have already been cleaned by ESET in the mean time.