Some days ago, this problem also exists! It's a headache! Using anti-virus software such as NOD32, rising, and McAfee does not help! Only McAfee found two files, EQ and TT, under system32, but after clearing them, they will be automatically generated later! No hair is always cleared completely!
The problem is that it is on sqlserver. I checked the relevant information on the Internet and finally noticed the stored procedure.Xp_mongoshell, Online explanation:
The command shell of the xp_cmdshell operating system. This process is an extended stored procedure used to execute a specified command string and return any output as a text line. In general, xp_mongoshell is unnecessary for administrators. The elimination of xp_mongoshell will not affect the server. -- Close comshell
Use master
Exec sp_dropextendedproc 'xp _ export shell'
-- Open comshell
Use master
Exec sp_addextendedproc 'xp _ cmdshell', 'xp log70. dll'