又被挖矿，求解决方案

Posted 2020-10-30

运气好得不得了，又被挖矿了，而且这次完全没有头绪。简单说下目前掌握的信息。
1.父进程是svchost.exe -k netsvcs。父进程svchost启动的挖矿进程是svchost.exe。

指向的地址是http://91.121.2.76:80
直接在浏览器中访问的话能看到 pool.minexmr.com 030418 online id 1101000

2.杀进程不起作用，过一会会自动启动。
3.杀毒扫不出任何东西。
4.任务管理器进程命令行看不到任何代码。
5.通过process expleror 工具查看内存找到了个C:\Windows\System32\wbem\xml\wmixml.dat文件，内容是xmrig的配置文件。内存中显示的xmrig版本是2.4.3。

{
    "algo": "cryptonight",  // cryptonight (default) or cryptonight-lite
    "av": 0,                // algorithm variation, 0 auto select
    "background": false,    // true to run the miner in the background
    "colors": true,         // false to disable colored output    
    "cpu-affinity": null,   // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1
    "cpu-priority": null,   // set process priority (0 idle, 2 normal to 5 highest)
    "donate-level": 5,      // donate level, mininum 1%
    "log-file": null,       // log all output to a file, example: "c:/some/path/xmrig.log"
    "max-cpu-usage": 1,    // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.  
    "print-time": 60,       // print hashrate report every N seconds
    "retries": 5,           // number of times to retry before switch to backup server
    "retry-pause": 5,       // time to pause between retries
    "safe": false,          // true to safe adjust threads and av settings for current CPU
    "threads": null,        // number of miner threads
    "pools": [
        {
            "url": "91.121.2.76:80",   // URL of mining server pool.minexmr.com
            "user": "465Qh6sTNHzf5Tmn2NHTUrJau7QYxTRPr7qwAH3va68pYNXPyqT23oAAQWdvKBEr8wCVEZWHo8ce5e1yGLNfJ3sZHSVskP9.rg299",                        // username for mining server
            "pass": "x",                       // password for mining server
            "keepalive": false,                 // send keepalived for prevent timeout (need pool support)
            "nicehash": false                  // enable nicehash/xmrig-proxy support
        }
    ],
    "api": {
        "port": 0,                             // port for the miner API https://github.com/xmrig/xmrig/wiki/API
        "access-token": null,                  // access token for API
        "worker-id": null                      // custom worker-id for API
    }
}

5.svchost的注册表也看了，里面没有啥明显的异常。
svchost netsvcs 注册的服务
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
FastUserSwitchingCompatibility
Ias
Irmon
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
SENS
Sharedaccess
SRService
Tapisrv
Wmi
WmdmPmSp
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
AppMgmt
iphlpsvc
seclogon
AppInfo
msiscsi
EapHost
schedule
sacsvr
winmgmt
MMCSS
browser
ProfSvc
SessionEnv
wercplsupport
hkmsvc
Themes
DsmSvc
NcaSvc
6.目前的临时手段是把wmixml.dat这个文件删掉，然后删掉挖矿的svchost进程。该挖矿进程就不会再起来了。但只要把wmixml.dat文件放回来，挖矿进程就还会出现。

不知道有没有同学遇到过一样的问题，望不吝赐教。