I have seen this virus before, I don't recall the exact wallet address but I am sure that the second pool was Nicehash (Japan) , I have fixed this issue , although I don't know the cause, but here is what I did to fix it once and for all.
1-Get a new laptop/pc which has never been on the same LAN ( doesn't have to be brad new, it has to be new to the LAN)
2-Disconnect every miner, keep 1 miner only ( you need to fix them one at the time)
3-Reset the miner using the IP report button method ( make sure you do it right)
4-Immediately and right after the miner's IP shows up, change the password with a very complex one
now this step needs a bit of preparation, in order to do it the right way, I suggest the following
a-Alter your DHCP setting on the router to allow only 1 IP address, so that you always know the IP the miner is going to take
b-Type the URL in advanced
http://192.168.X.X/administration.html (depending on the IP your miner is going to use)
c-Right after the miner turns on , refresh the page, as soon as it shows up, change the password)
5-Flash the latest firmware afterwards.
**Make sure you follow these steps , it should work , if everything goes fine, you need to learn how to protect your miners in the future.