CoreGuard Antivirus 2009 attacked Windows 10 pro, and Debian as well

Archive
1

Hello.
I am kind of a security/privacy conscious person.
On my desktop, I have Debian and Windows 10 pro.

Yesterday, my debian setup was acting up, but I didn't think much about it. Whenever I was trying to access password vault/manager from firefox, I was getting error "something went wrong, try again later".
A few hours ago, I logged into the windows 10 pro, and it seemed normal at first glance. But the password vault was not opening there. I tried to update the firefox, but it said "couldnt check for updates". I thought something was up with password vault, so I tried to look it up online.
Surprisingly, I couldnt open any domain containing the name "norton".
So as I do regularly, I ran the live update, and initiated a full system scan. Thats when the CoreGuard Antivirus 2009 caught my eye when Norton 360 was scanning it. The complete scan did not detect any threats.
I looked it up, and as per suggestions, I tried to run Norton Power Eraser, but in the very beginning, it could not connect to the server, and it failed completely to scan the system.

I tried again to visit Norton site, but I could never visit it. Then out of curiosity, I visited a few banking websites (that I do not have accounts with), and they were sort of slow to load.

Then I logged in to Debian, and some system related software were not even initiating. I tried to visit Norton site(s), but they did not load even on Debian. I tried to open some media files, and even the VLC media player is not initiating at all.

My question is:
I am willing to perform clean installation of both the Windows 10, as well as Debian. But the thing is, I have 500GB SSD where I have both the operating systems, and I have a 2TB internal HDD (NTFS).
To access that HDD from debian, I first have to mount it. I had mounted that HDD once since the system was acting up. Now I am unable to mount it (thats why I am doubting debian was affected as well, among other reasons). So to copy some data, I might have to connect some thumb drive, or USB HDD.

That brings us to the real question: if I perform clean installation of both the operating systems (on SSD), is there a possibility of infection from the internal HDD or the external drive that I might need to copy the data?

What should I do, and what might have caused the infection/attack in the first place? I rarely visit suspicious sites from Windows. Even on Debian, I avoid visiting unknown/suspicious sites. I am kind of surprised that even my Windows got infected.

Any help/suggestions will be appreciated a lot.
Regards,
Kiran.

2

If you installed Avast, did you uninstall Norton first?  Having two real time AV products installed can cause conflicts and actually reduce your protection as the two fight for the same resources at the same time.

 

3

kiran98se:
there definitely is a virus/malware

Please run Norton Full Scan & Malwarebytes Threat Scan.  

Were my machine and I wanted reassurance.
I'd ask Malwarebytes Malware Removal Help Forums to check my machine.  

Malwarebytes offers free second opinion on-demand scanner. 
Malwarebytes offers free self-help guides. 
Malwarebytes offers free one-on-one malware removal assistance.
Malwarebytes staff & experts help all.  Malwarebytes subscription is not required. 

Malware Removal Help Forums dedicated to cleaning infected devices. Get personalized help removing adware, malware, spyware, ransomware, trojans, viruses and more from tech experts. Follow the instructions in the pinned topics first. All assistance here is used at your own risk and we take no responsibility should there be damage to the system in question.

4

Hello. Thanks for the reply.
Now I cant be sure if it was "checking for", or if it was the path of the directory which was being scanned.

In either case, I am not able to visit any page to Norton, not getting connected to the server(s) of antiviruses including Norton.
After posting the question above, I tried to install Avast, but it said could not connect to the internet. So I installed it with offline installer. After initiating the installer, I got a pop-up saying Windows defender (or security) is not available (something along these lines).

Whether its CoreGaurd or not, there definitely is a virus/malware.

5

                Checking for: CoreGuardAntivirus2009

6

Thats when the CoreGuard Antivirus 2009 caught my eye when Norton 360 was scanning it. The complete scan did not detect any threats.

FYI  The items you see listed during a scan are items Norton is looking for. Not what they have found on your system. That is why no threats were detected. At least why CoreGuard was not detected.

 I'll leave more technical diagnosis of you problem to those with more experience with dual boot Linux systems.  It is difficult to know which OS has been affected that is causing your issues.