近几个月经常发现使用计算机时突然冒出DOS窗口一闪，后检查在C盘根目录下发现可疑日志文件testlog.lvr：
Service is Running
Service_Exit
08-02-01 12:34:52 EnterThread
08-02-01 21:44:23 EnterThread
08-02-01 21:49:52 DownedNew0808
08-02-01 21:49:58 StartChecker.dll.
08-02-01 21:50:16 Threa..d..Proc..Ext
08-02-01 21:52:19 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-01 21:59:20 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 2202456F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2EF13AE7A324C6566
08-02-01 22:03:29 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 4202756F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2A6E275C17F12DB5271C528B068AA8EC11AE96627AC9C17B37D2564A812099D4DE990669B4A082633
08-02-01 22:24:21 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 2D02779DA0BF3DDFECA897020D441A6200956CFBAF44A8CF451E7DEC0A75268885112C6CBD9C87587B5AA0BC4493CE41D43E20D6B77E9006C1D652BC3A4BA983D9ACB15C2260A023FF53311BB410B7A165E481AECB14560CC80A3EE830CCF5363A117
08-02-01 22:27:36 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-01 22:49:23 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 2202456F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2EF13AE7A324C6566
08-02-01 23:05:37 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-01 23:26:07 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 2202456F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2EF13AE7A324C6566
08-02-01 23:43:37 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-01 23:51:29 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 4202756F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2A6E275C17F12DB5271C528B068AA8EC11AE96627AC9C17B37D2564A812099D4DE990669B4A082633
08-02-02 00:00:15 ReadUpUpve
08-02-02 00:21:38 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-02 00:51:17 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 2202456F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2EF13AE7A324C6566
08-02-02 00:59:37 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-02 01:36:05 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 2202456F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2EF13AE7A324C6566
08-02-02 01:39:05 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
08-02-02 01:46:16 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 4202756F8F1B1911274F45CDAE54C39BC2010EDC5C9793AAB2293BC716DE75476E6940A3109C694D04CA65CDAE54C39BC20101CC5FAC7FCBC0BE2A6E275C17F12DB5271C528B068AA8EC11AE96627AC9C17B37D2564A812099D4DE990669B4A082633
08-02-02 02:17:07 Ready: C:\WINDOWS\system32\wbem\2714\svchost.exe 160273581FD56651FCD70759D641DA289C1E5BB0A0CFE1AE5EE90EBF88C1C9DBBEA39AA7950E3B35AFED9F0BB1804E2EB35C45B4304334C2699F34E6E0E2EFBA55D9A61CD4606B1FEAC56CD8CFF8398ABD3F33DA25AB4B1C23E62A99E729759CBF4B7
Service is Running
……
按其中目录查找：
C:\WINDOWS\system32\wbem>dir
驱动器 C 中的卷是 WinXP
卷的序列号是 6C0A-92D6
C:\WINDOWS\system32\wbem 的目录
2008-05-07 01:08 <DIR> .
2008-05-07 01:08 <DIR> ..
2008-01-11 04:33 <DIR> 2065
2008-01-22 12:45 <DIR> 2379
2008-05-07 01:06 <DIR> 2714
2008-01-22 12:45 <DIR> 4058
2008-05-07 01:07 <DIR> 4251
2008-01-10 21:09 <DIR> 4475
2008-01-11 04:33 <DIR> 5599
2008-05-07 01:07 <DIR> 5752
2008-01-11 04:33 <DIR> 5821
2008-01-11 04:33 <DIR> 5929
2008-02-01 08:17 <DIR> 5937
2008-01-11 04:33 <DIR> 6250
2008-05-07 01:08 <DIR> 6352
2008-01-22 12:45 <DIR> 6924
2008-01-29 08:14 <DIR> 7081
2008-01-22 12:45 <DIR> 7854
2008-04-13 17:23 <DIR> AutoRecover
2004-08-04 08:52 1,350,144 cimwin32.dll
2004-07-18 06:56 1,088,148 cimwin32.mfl
2004-08-04 06:00 2,774,228 cimwin32.mof
2004-08-04 06:00 29,290 cli.mof
……
C:\WINDOWS\system32\wbem\2714 的目录
2008-01-29 08:14 <DIR> .
2008-01-29 08:14 <DIR> ..
2008-01-29 08:14 24,039 svchost.exe
1 个文件 24,039 字节
……
C:\WINDOWS\system32\wbem\AutoRecover 的目录
2008-04-13 17:23 <DIR> .
2008-04-13 17:23 <DIR> ..
2007-11-11 14:42 24,318 02E78424AB18BDBFA706C08B7D7B9F1D.mof
2007-11-11 14:42 23,798 092389D621F5A8834203DAAC74CCA279.mof
2007-11-11 14:42 130,456 0A9DBC92D554324656F61F9862679F27.mof
2007-11-11 14:42 7,694 1E97A05DE566CF6EEAE29D0634E27392.mof
2008-04-13 17:23 107,496 1EBE968EB7AF815A32641E6185350A9E.mof
2007-11-11 14:42 2,076 20D2C3B8CE10B96CE6B8A3C241EF4416.mof
2007-11-28 14:12 23,318 21D7529435092A1DD242FD6ACF494493.mof
2007-11-11 23:36 28,564 23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
2007-11-11 14:42 2,774,334 26C097A9392F8C541AD42E89B7909073.mof
2007-11-11 14:42 6,042 26D6C4EB696DD0C83F5D5BF2235000A7.mof
2007-11-11 14:42 9,034 2A61A823DC2C1C838EE71C4351BED0B4.mof
2007-11-11 14:42 41,508 2AA23BB86A5EBD8BC2D820944E55B233.mof
2007-11-11 14:42 13,448 2C142C4C15E3B8D139B98154CD083071.mof
2007-11-11 14:42 23,926 2CE64FBD51953C097BB5470043A6DAF9.mof
2007-11-11 14:42 12,256 2CFB5B149FA396D1AEA5F89B1C5A8D81.mof
2007-11-11 14:42 3,182 2DA80135BA8EC175C9B1C1598F659434.mof
2007-11-11 14:42 29,862 37134956F76D3C30C9BE0C12571CAF43.mof
2007-11-11 14:42 1,088,254 3EC317800FF508210BB945C81C0EACE7.mof
2007-11-28 14:03 934,120 3F545850B179CDF8F887A4653342B138.mof
2007-11-11 14:42 13,986 42355E8E232EF8CADD187D531DEC55DD.mof
2007-11-11 14:42 16,914 42C894EEACAD83A4E41154685841B3E1.mof
2007-11-28 14:03 140,630 455AC6BE6CB1F60B8C1048CD4AB2446F.mof
2007-11-11 14:42 19,372 608B41C6A2CD9460C2263E6CD80C335A.mof
2007-11-11 14:42 3,908 60A06765DDFE47EF7240BD9C1EB29EFE.mof
2007-11-28 14:12 12,744 61A97B69A191C34F4DC1D3F8A3C57015.mof
2007-11-11 14:42 63,686 6B38F33147D0369D5038BBB61C7A31C8.mof
2007-11-11 14:45 8,820 6FFF7467A5B40765D5740A413CA8BB8A.mof
2007-11-11 14:42 42,818 701B705ED7DF100F88D5BC4A595E938D.mof
2007-11-11 14:42 110,752 72F867EF62976CE9F70993FF3E68A4EB.mof
2007-11-11 14:42 43,182 731AE1FC8C795979F40FAD645FFBAEB1.mof
2007-11-11 14:42 15,688 79E817BC978E2D450EB9E3794DFDA6CF.mof
2007-11-11 14:42 3,322 7A62FA52E22CE751514BC93BE067BC80.mof
2007-11-11 14:42 3,092 852ECCDBABE77624586E4417FE66F857.mof
2007-11-11 14:42 12,818 8636DC7F9479DACE6778109CB4FB4B01.mof
2007-11-11 23:35 29,386 88744D2A29102FC88ECF505DD2E984FC.mof
2007-11-11 22:36 149,050 8A94AF24F162D580E3D9889344A3A317.mof
2007-11-28 14:07 21,220 8C3950A676B7DE5D170DFC7D615E489D.mof
2007-11-11 14:42 7,546 958A50DFF8A9DF5FAEA042AC9F60815F.mof
2007-11-11 14:45 2,566 9AD3182A2F39A3E091E15109132EC6CC.mof
2007-11-11 14:42 46,478 A7575F8DE31A912FFE91A7A41B1E382A.mof
2007-11-11 14:42 9,026 A99860BB696AE92ED001E48B014365CE.mof
2007-11-11 14:42 5,404 ABB70D53B97FC8002205F77E02C97304.mof
2007-11-11 14:42 19,462 AE7023598F41510BF261111652046301.mof
2007-11-11 14:42 6,486 AEA50E449C23761CA4D9B7F9ED0D9C89.mof
2007-11-28 14:12 20,142 B8F066315788F9A2DF744CF3A9F7F3D6.mof
2007-11-11 14:42 32,770 BE81B2C0741907C1FC1C42B6223E59AD.mof
2007-11-11 14:45 88,742 C3A0BE17B37ACE48BE78B31580231AE9.mof
2007-11-11 14:42 99,856 C6300BFE37ADE6B52EC023F66124985F.mof
2007-11-11 14:42 18,500 C81ACF420917AA0F87487BC4D958BEB4.mof
2007-11-11 23:36 2,570,652 C8463ECBE33BC240263A0B094E46D510.mof
2007-11-11 14:42 18,144 C92641594A6F2DA8A55FE4738AFDA539.mof
2007-11-11 14:42 25,862 CA0106054EB09C302ED3E0669F99D021.mof
2007-11-11 14:42 4,496 CFC35B349D24A8495FD2CEAB15C32D88.mof
2007-11-11 14:45 222,422 D724DF13E0B0DF051EB5D403DD8EF2FC.mof
2007-11-11 14:42 4,092 D92470B796B6B18F9EE52301857F0567.mof
2007-11-11 14:42 6,248 DBD781C2C031C708BCB490F228E7BEF9.mof
2007-11-11 14:42 165,526 DC999686F8B85B326CEDFA199DD07F72.mof
2008-04-13 17:23 29,388 DFB9AD54AC2D3B8122567AAD3BF3EB7F.mof
2007-11-11 14:42 12,692 DFD614E4D613EF4506AC8F525F5F514B.mof
2007-11-11 14:42 10,784 E04DE4CDFEC284A342159BB920976701.mof
2007-11-11 14:42 10,848 E441354B9FE5F63362A481C9B9195A73.mof
2007-11-11 14:42 58,852 E737DE61441445E1FDFCA45EF5E7D987.mof
2007-11-11 14:42 6,600 EDBF963FB003D0670AA9C2219BD091FB.mof
2007-11-11 14:42 61,314 FAAD7D567E76CAB10704AFD7C0488F23.mof
64 个文件 9,559,972 字节
……
不知C:\WINDOWS\system32\wbem下带数字的目录中的svchost.exe是否是病毒？
将可疑的日志和C:\WINDOWS\system32\wbem下带数字的目录中的svchost.exe附上（文件名后加了.txt），请那位高手鉴定下是否病毒或木马？
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
