又被挖矿，求解决方案

标签：挖矿   svchost   xmrig   wmixml.dat   

2.杀进程不起作用，过一会会自动启动。
3.杀毒扫不出任何东西。
4.任务管理器进程命令行看不到任何代码。
5.通过process expleror 工具查看内存找到了个C:\Windows\System32\wbem\xml\wmixml.dat文件，内容是xmrig的配置文件。内存中显示的xmrig版本是2.4.3。

{
    "algo": "cryptonight",  // cryptonight (default) or cryptonight-lite
    "av": 0,                // algorithm variation, 0 auto select
    "background": false,    // true to run the miner in the background
    "colors": true,         // false to disable colored output    
    "cpu-affinity": null,   // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1
    "cpu-priority": null,   // set process priority (0 idle, 2 normal to 5 highest)
    "donate-level": 5,      // donate level, mininum 1%
    "log-file": null,       // log all output to a file, example: "c:/some/path/xmrig.log"
    "max-cpu-usage": 1,    // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.  
    "print-time": 60,       // print hashrate report every N seconds
    "retries": 5,           // number of times to retry before switch to backup server
    "retry-pause": 5,       // time to pause between retries
    "safe": false,          // true to safe adjust threads and av settings for current CPU
    "threads": null,        // number of miner threads
    "pools": [
        {
            "url": "91.121.2.76:80",   // URL of mining server pool.minexmr.com
            "user": "465Qh6sTNHzf5Tmn2NHTUrJau7QYxTRPr7qwAH3va68pYNXPyqT23oAAQWdvKBEr8wCVEZWHo8ce5e1yGLNfJ3sZHSVskP9.rg299",                        // username for mining server
            "pass": "x",                       // password for mining server
            "keepalive": false,                 // send keepalived for prevent timeout (need pool support)
            "nicehash": false                  // enable nicehash/xmrig-proxy support
        }
    ],
    "api": {
        "port": 0,                             // port for the miner API https://github.com/xmrig/xmrig/wiki/API
        "access-token": null,                  // access token for API
        "worker-id": null                      // custom worker-id for API
    }
}

5.svchost的注册表也看了，里面没有啥明显的异常。
svchost netsvcs 注册的服务
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
FastUserSwitchingCompatibility
Ias
Irmon
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
SENS
Sharedaccess
SRService
Tapisrv
Wmi
WmdmPmSp
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
AppMgmt
iphlpsvc
seclogon
AppInfo
msiscsi
EapHost
schedule
sacsvr
winmgmt
MMCSS
browser
ProfSvc
SessionEnv
wercplsupport
hkmsvc
Themes
DsmSvc
NcaSvc
6.目前的临时手段是把wmixml.dat这个文件删掉，然后删掉挖矿的svchost进程。该挖矿进程就不会再起来了。但只要把wmixml.dat文件放回来，挖矿进程就还会出现。

不知道有没有同学遇到过一样的问题，望不吝赐教。

又被挖矿，求解决方案

标签：挖矿   svchost   xmrig   wmixml.dat   

原文地址：http://blog.51cto.com/640006/2097393