Just got this to work

Electroneum
globalminer sgminer-gm-xmr
sgminer-gm-xmr=proxypool1 stratum+tcp://pool.electroneum.space:7777
sgminer-gm-xmr=proxypool2 stratum+tcp://pool.electroneum.space:7777
sgminer-gm-xmr=proxywallet your wallet here
sgminer-gm-xmr=poolpass1 x
sgminer-gm-xmr=poolpass2 x
Remove worker from sgminer-gm-xmr.stub.conf
{
"pools": [{
"url": "POOL1",
"user": "WALLET",
"pass": "PASSWORD1"
},
{
"url": "POOL2",
"user": "WALLET",
"pass": "PASSWORD2"
sorry no idea on nicehash
WARNING: Do not use the pool listed above. The URL contains malware.
Just go with the well known electroneum pools like easyhash.io, electroneum.fr, or even electroneum.hashparty.io.
You won't be finding any blocks anyway if the pool hashrate is so low.
Someone hasn't done their homework here. The pool offer a Miner page to mine directly from the browser without downloading and configuring any mining software. Simply providing an Electroneum address is supposed to pay any pool earnings to that wallet. You are most likely reacting to your anti-virus software alerts rather than responding to them appropriately. If you look you'll see that the malware you speak of is not malware at all but just a miner that the site operators have provided for ease of use.