The problem is I on ali cloud server deployed two web applications, system is Windows server 2012 R2, but after a while the server is very card,
Then I see the login server process will find that there are many MSCL process, have rushed to 100% of the CPU, turn off the cis, but every now and then automatically run out, inquire of people know this process is stem what of, why will automatically appear?

CodePudding user response:

Suspected virus, have a look at the file location, and file information

CodePudding user response:

reference 1st floor Runnerchin response:

suspected virus, have a look at the file location and file information

See the process name is MSCL describe MSCL file location is C://users/local/temp/1/RarSFX1 MSCL. Exe
For service there is no which program should be called MSCL generated, ban RarSFX1 folder will be deleted after the process, but after an hour come out again

CodePudding user response:

This directory is rar self-extracting generated temporary directory, recall when there is this phenomenon, and then find out the time near create self-extracting procedure,

CodePudding user response:

First to be sure this program is not original file system, CPU must have a problem for a long time, the basic is concluded that a virus or Trojan, suggest full search, including the registry key, delete all,

CodePudding user response:

I ran into this problem and solves the problems of how to solve the original poster

CodePudding user response:

Is a virus file generated by the MC - serv,


Risk description high-risk
Install Windows from startup
Information running Windows XP SP3 + PDF11
Suspicious behavior
Since the launch of [-] install Windows item (1)
[-] file
"C: \ \ WINDOWS \ \ win ini"
The process tree

48 a1dc49a7e650f2fda6407eb48aae1cf11c107ef2f7b6b58e3f259536f202d8. Exe

File release
[+] libeay32. DLL
[+] zlib1. DLL
[+] libwinpthread - 1. DLL
[+] MSCL. Exe
[+] ssleay32. DLL
[+] libcurl - 4. DLL
[+] __tmp_rar_sfx_access_check_35958766
Details
[-] 48 a1dc49a7e650f2fda6407eb48aae1cf11c107ef2f7b6b58e3f259536f202d8. Exe (the current process number: 1984, the parent number: 1060) (1630)
[+] system function call
[+] process function call
[+] registry function call
[+] file function call
[+] other function calls

CodePudding user response:

https://x.threatbook.cn/report/scan/48a1dc49a7e650f2fda6407eb48aae1cf11c107ef2f7b6b58e3f259536f202d8-1496837196192