瑞星卡卡安全论坛

签到~~~



http://bbs.ikaka.com/showtopic-8588004.aspx

http://bbs.ikaka.com/showtopic-8587994.aspx

http://bbs.ikaka.com/showtopic-8587473.aspx

http://bbs.ikaka.com/showtopic-8587524.aspx

http://bbs.ikaka.com/showtopic-8587857.aspx

http://bbs.ikaka.com/showtopic-8587869.aspx

http://bbs.ikaka.com/showtopic-8587885.aspx

http://bbs.ikaka.com/showtopic-8588006.aspx

http://bbs.ikaka.com/showtopic-8588016.aspx

http://bbs.ikaka.com/showtopic-8588007.aspx

http://bbs.ikaka.com/showtopic-8588021.aspx

http://bbs.ikaka.com/showtopic-8588039.aspx

http://bbs.ikaka.com/showtopic-8588050.aspx

http://bbs.ikaka.com/showtopic-8588053.aspx

http://bbs.ikaka.com/showtopic-8588065.aspx

http://bbs.ikaka.com/showtopic-8588087.aspx

http://bbs.ikaka.com/showtopic-8588112.aspx

http://bbs.ikaka.com/showtopic-8588169.aspx

http://bbs.ikaka.com/showtopic-8588104.aspx
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )

签到~


http://bbs.ikaka.com/showtopic-8588332.aspx

http://bbs.ikaka.com/showtopic-8588282.aspx

http://bbs.ikaka.com/showtopic-8588292.aspx

http://bbs.ikaka.com/showtopic-8588263.aspx

http://bbs.ikaka.com/showtopic-8588301.aspx

http://bbs.ikaka.com/showtopic-8588327.aspx

http://bbs.ikaka.com/showtopic-8588332.aspx

http://bbs.ikaka.com/showtopic-8588335.aspx

http://bbs.ikaka.com/showtopic-8588338.aspx

http://bbs.ikaka.com/showtopic-8588340.aspx

http://bbs.ikaka.com/showtopic-8588521.aspx

http://bbs.ikaka.com/showtopic-8588331.aspx

http://bbs.ikaka.com/showtopic-8588357.aspx

http://bbs.ikaka.com/showtopic-8588358.aspx

http://bbs.ikaka.com/showtopic-8588370.aspx

http://bbs.ikaka.com/showtopic-8588379.aspx

http://bbs.ikaka.com/showtopic-8588430.aspx

http://bbs.ikaka.com/showtopic-8588442.aspx

[/url]

签到


http://bbs.ikaka.com/showtopic-8588532.aspx

http://bbs.ikaka.com/showtopic-8588567.aspx

http://bbs.ikaka.com/showtopic-8588579.aspx

http://bbs.ikaka.com/showtopic-8588599.aspx

http://bbs.ikaka.com/showtopic-8588606.aspx

http://bbs.ikaka.com/showtopic-8588654.aspx

http://bbs.ikaka.com/showtopic-8588655.aspx

http://bbs.ikaka.com/showtopic-8588667.aspx

http://bbs.ikaka.com/showtopic-8588669.aspx

http://bbs.ikaka.com/showtopic-8588674.aspx

http://bbs.ikaka.com/showtopic-8588681.aspx

http://bbs.ikaka.com/showtopic-8588683.aspx

http://bbs.ikaka.com/showtopic-8588686.aspx

http://bbs.ikaka.com/showtopic-8588702.aspx

http://bbs.ikaka.com/showtopic-8588709.aspx

http://bbs.ikaka.com/showtopic-8588723.aspx

http://bbs.ikaka.com/showtopic-8588726.aspx

http://bbs.ikaka.com/showtopic-8588727.aspx

http://bbs.ikaka.com/showtopic-8588729.aspx

http://bbs.ikaka.com/showtopic-8588736.aspx

http://bbs.ikaka.com/showtopic-8588760.aspx

http://bbs.ikaka.com/showtopic-8588847.aspx

签到



http://bbs.ikaka.com/showtopic-8588955.aspx

[url=http://bbs.ikaka.com/showtopic-8588815.aspx]http://bbs.ikaka.com/showtopic-8588815.aspx[/url]

http://bbs.ikaka.com/showtopic-8588918.aspx

http://bbs.ikaka.com/showtopic-8588962.aspx

http://bbs.ikaka.com/showtopic-8588985.aspx

http://bbs.ikaka.com/showtopic-8588988.aspx

http://bbs.ikaka.com/showtopic-8588989.aspx

http://bbs.ikaka.com/showtopic-8588994.aspx

http://bbs.ikaka.com/showtopic-8589014.aspx

http://bbs.ikaka.com/showtopic-8589056.aspx

http://bbs.ikaka.com/showtopic-8589092.aspx

http://bbs.ikaka.com/showtopic-8589096.aspx

http://bbs.ikaka.com/showtopic-8589097.aspx

http://bbs.ikaka.com/showtopic-8589122.aspx

http://bbs.ikaka.com/showtopic-8589130.aspx

http://bbs.ikaka.com/showtopic-8589136.aspx

签到


http://bbs.ikaka.com/showtopic-8589143.aspx

http://bbs.ikaka.com/showtopic-8589152.aspx

http://bbs.ikaka.com/showtopic-8589134.aspx

http://bbs.ikaka.com/showtopic-8589219.aspx

http://bbs.ikaka.com/showtopic-8589272.aspx

http://bbs.ikaka.com/showtopic-8589216.aspx

http://bbs.ikaka.com/showtopic-8589210.aspx

http://bbs.ikaka.com/showtopic-8589169.aspx

http://bbs.ikaka.com/showtopic-8589225.aspx

http://bbs.ikaka.com/showtopic-8589226.aspx

http://bbs.ikaka.com/showtopic-8589265.aspx

http://bbs.ikaka.com/showtopic-8589290.aspx

http://bbs.ikaka.com/showtopic-8589320.aspx

http://bbs.ikaka.com/showtopic-8589347.aspx

http://bbs.ikaka.com/showtopic-8589349.aspx

签到





[url=http://bbs.ikaka.com/showtopic-8589600.aspx]http://bbs.ikaka.com/showtopic-8589600.aspx[/url]

http://bbs.ikaka.com/showtopic-8589494.aspx

http://bbs.ikaka.com/showtopic-8589471.aspx

http://bbs.ikaka.com/showtopic-8589491.aspx

http://bbs.ikaka.com/showtopic-8589502.aspx

http://bbs.ikaka.com/showtopic-8589506.aspx

http://bbs.ikaka.com/showtopic-8589508.aspx

http://bbs.ikaka.com/showtopic-8589580.aspx

http://bbs.ikaka.com/showtopic-8589587.aspx

http://bbs.ikaka.com/showtopic-8589595.aspx

http://bbs.ikaka.com/showtopic-8589611.aspx

http://bbs.ikaka.com/showtopic-8589614.aspx

http://bbs.ikaka.com/showtopic-8589706.aspx

http://bbs.ikaka.com/showtopic-8589618.aspx

http://bbs.ikaka.com/showtopic-8589621.aspx

http://bbs.ikaka.com/showtopic-8589623.aspx

http://bbs.ikaka.com/showtopic-8589703.aspx

http://bbs.ikaka.com/showtopic-8589665.aspx
[/url]

签到


http://bbs.ikaka.com/showtopic-8589829.aspx

[url=http://bbs.ikaka.com/showtopic-8589716.aspx]http://bbs.ikaka.com/showtopic-8589716.aspx[/url]

http://bbs.ikaka.com/showtopic-8589621.aspx

http://bbs.ikaka.com/showtopic-8589818.aspx

http://bbs.ikaka.com/showtopic-8589824.aspx

http://bbs.ikaka.com/showtopic-8589825.aspx

http://bbs.ikaka.com/showtopic-8589896.aspx

http://bbs.ikaka.com/showtopic-8589794.aspx

http://bbs.ikaka.com/showtopic-8589900.aspx

http://bbs.ikaka.com/showtopic-8589902.aspx

http://bbs.ikaka.com/showtopic-8589988.aspx

http://bbs.ikaka.com/showtopic-8590001.aspx
[/url]

对楼主在http://bbs.ikaka.com/showtopic-8588004.aspx回复的点评：

评价：没有抓住问题的核心，以下是个人判别的日志异常部分：
=================================
服务：
[dgckca / dgckca][Stopped/Auto Start]
  <C:\WINDOWS\system32\SVCHOST.EXE -kdgckca-->%SystemRoot%\System32\feacxn.dll><N/A>
[Safe / Safe][Stopped/Auto Start]
  <C:\PRogram Files\wim\360safe><N/A>

两个病毒创建的服务，说明如下：

对第一个，只要熟悉系统的常见服务名称、系统服务在注册表中显示的子项名称，就能立刻发现这个服务的异常，再结合GOOGLE，不难得出结论（小知识：[dgckca / dgckca]，反斜杠前的部分为服务名称，反斜杠后的部分为服务在注册表中显示的子项名称）；
对第二个，识别可从三部分进行，一是映像文件本身。病毒创建的这个服务对应的映像文件在SRENG日志中没有显示扩展名，说明该文件确实无扩展名，此为破绽一；二是映像文件所在路径，就算是360的东西，怎么会在WIM这个陌生的文件夹下呢？此为破绽二；三是对360安全工具的熟悉程度，可发现此服务有问题，此为破绽三。
=================================
【建议】：楼主积极回帖的精神值得赞许，但回帖需要提高质量，也要加强对操作系统基础知识的了解。个人以为帖子要贵在精，而不在多。

以上纯属个人意见，为抛砖引玉，供参考。

对了，以上是对反病毒区回帖的要求，楼主在别的区的回帖，看了基本还是不错的……:default15:

签到




[url=http://bbs.ikaka.com/showtopic-8590162.aspx]http://bbs.ikaka.com/showtopic-8590162.aspx[/url]
http://bbs.ikaka.com/showtopic-8590150.aspx
http://bbs.ikaka.com/showtopic-8590168.aspx
http://bbs.ikaka.com/showtopic-8590188.aspx
http://bbs.ikaka.com/showtopic-8590191.aspx
http://bbs.ikaka.com/showtopic-8590266.aspx
http://bbs.ikaka.com/showtopic-8590269.aspx
http://bbs.ikaka.com/showtopic-8590286.aspx
http://bbs.ikaka.com/showtopic-8590324.aspx
http://bbs.ikaka.com/showtopic-8590031.aspx

签到


http://bbs.ikaka.com/showtopic-8590023.aspx


http://bbs.ikaka.com/showtopic-8590566.aspx

http://bbs.ikaka.com/showtopic-8590333.aspx

http://bbs.ikaka.com/showtopic-8590586.aspx

http://bbs.ikaka.com/showtopic-8590578.aspx

http://bbs.ikaka.com/showtopic-8590570.aspx

http://bbs.ikaka.com/showtopic-8590562.aspx

http://bbs.ikaka.com/showtopic-8590383.aspx


[/url]

签到



http://bbs.ikaka.com/showtopic-8590770.aspx



http://bbs.ikaka.com/showtopic-8590585.aspx

http://bbs.ikaka.com/showtopic-8590466-2.aspx

http://bbs.ikaka.com/showtopic-8590601.aspx

http://bbs.ikaka.com/showtopic-8590709.aspx

http://bbs.ikaka.com/showtopic-8590714.aspx

http://bbs.ikaka.com/showtopic-8590742.aspx

http://bbs.ikaka.com/showtopic-8590839.aspx

http://bbs.ikaka.com/showtopic-8590829.aspx

http://bbs.ikaka.com/showtopic-8590826.aspx

http://bbs.ikaka.com/showtopic-8590750.aspx

http://bbs.ikaka.com/showtopic-8590777.aspx

http://bbs.ikaka.com/showtopic-8590786.aspx

http://bbs.ikaka.com/showtopic-8590812.aspx

http://bbs.ikaka.com/showtopic-8590748.aspx

http://bbs.ikaka.com/showtopic-8590819.aspx
[/url]

签到



http://bbs.ikaka.com/showtopic-8590853.aspx

http://bbs.ikaka.com/showtopic-8590849.aspx

http://bbs.ikaka.com/showtopic-8590839.aspx

http://bbs.ikaka.com/showtopic-8590860.aspx

http://bbs.ikaka.com/showtopic-8590871.aspx

http://bbs.ikaka.com/showtopic-8590941.aspx

http://bbs.ikaka.com/showtopic-8590961.aspx

http://bbs.ikaka.com/showtopic-8590966.aspx

http://bbs.ikaka.com/showtopic-8590974.aspx

http://bbs.ikaka.com/showtopic-8591004.aspx

http://bbs.ikaka.com/showtopic-8591008.aspx

http://bbs.ikaka.com/showtopic-8590984.aspx

http://bbs.ikaka.com/showtopic-8590980.aspx

http://bbs.ikaka.com/showtopic-8591065.aspx

签到



http://bbs.ikaka.com/showtopic-8591127.aspx

http://bbs.ikaka.com/showtopic-8591225.aspx

http://bbs.ikaka.com/showtopic-8591145.aspx

http://bbs.ikaka.com/showtopic-8591149.aspx

http://bbs.ikaka.com/showtopic-8591142.aspx

http://bbs.ikaka.com/showtopic-8591190.aspx

签到


http://bbs.ikaka.com/showtopic-8591364.aspx

http://bbs.ikaka.com/showtopic-8591235.aspx

http://bbs.ikaka.com/showtopic-8591339.aspx

http://bbs.ikaka.com/showtopic-8591281.aspx

http://bbs.ikaka.com/showtopic-8591340.aspx

签到



http://bbs.ikaka.com/showtopic-8591718.aspx

http://bbs.ikaka.com/showtopic-8591721.aspx

http://bbs.ikaka.com/showtopic-8591519.aspx

http://bbs.ikaka.com/showtopic-8591572.aspx

http://bbs.ikaka.com/showtopic-8591590.aspx

http://bbs.ikaka.com/showtopic-8591692.aspx

http://bbs.ikaka.com/showtopic-8591719.aspx

http://bbs.ikaka.com/showtopic-8591422.aspx

http://bbs.ikaka.com/showtopic-8591738.aspx

http://bbs.ikaka.com/showtopic-8591727.aspx

http://bbs.ikaka.com/showtopic-8591737.aspx

签到



http://bbs.ikaka.com/showtopic-8592007.aspx

http://bbs.ikaka.com/showtopic-8591987.aspx

http://bbs.ikaka.com/showtopic-8592100.aspx

http://bbs.ikaka.com/showtopic-8592196.aspx

http://bbs.ikaka.com/showtopic-8592224.aspx

http://bbs.ikaka.com/showtopic-8592235.aspx

签到


http://bbs.ikaka.com/showtopic-8592346.aspx


http://bbs.ikaka.com/showtopic-8592235.aspx

http://bbs.ikaka.com/showtopic-8592224.aspx

http://bbs.ikaka.com/showtopic-8592255.aspx

http://bbs.ikaka.com/showtopic-8592345.aspx

http://bbs.ikaka.com/showtopic-8592388.aspx

http://bbs.ikaka.com/showtopic-8592357.aspx

http://bbs.ikaka.com/showtopic-8592351.aspx

http://bbs.ikaka.com/showtopic-8592438.aspx

http://bbs.ikaka.com/showtopic-8592467.aspx

http://bbs.ikaka.com/showtopic-8592434.aspx

签到


http://bbs.ikaka.com/showtopic-8592490.aspx

http://bbs.ikaka.com/showtopic-8592675.aspx

http://bbs.ikaka.com/showtopic-8592684.aspx

http://bbs.ikaka.com/showtopic-8592693.aspx

http://bbs.ikaka.com/showtopic-8592694.aspx

http://bbs.ikaka.com/showtopic-8592704.aspx

http://bbs.ikaka.com/showtopic-8592699.aspx

签到


http://bbs.ikaka.com/showtopic-8592856.aspx

http://bbs.ikaka.com/showtopic-8592846.aspx

http://bbs.ikaka.com/showtopic-8592957.aspx

http://bbs.ikaka.com/showtopic-8592963.aspx

http://bbs.ikaka.com/showtopic-8593002.aspx

签到

http://bbs.ikaka.com/showtopic-8593209.aspx

http://bbs.ikaka.com/showtopic-8592796.aspx

http://bbs.ikaka.com/showtopic-8593147.aspx

http://bbs.ikaka.com/showtopic-8593224.aspx

签到


http://bbs.ikaka.com/showtopic-8593579.aspx

http://bbs.ikaka.com/showtopic-8593443.aspx

http://bbs.ikaka.com/showtopic-8593628.aspx

http://bbs.ikaka.com/showtopic-8593578.aspx

http://bbs.ikaka.com/showtopic-8593461.aspx

签到

http://bbs.ikaka.com/showtopic-8593775.aspx

http://bbs.ikaka.com/showtopic-8593885.aspx

http://bbs.ikaka.com/showtopic-8593893.aspx

签到


http://bbs.ikaka.com/showtopic-8594037.aspx

http://bbs.ikaka.com/showtopic-8594041.aspx

http://bbs.ikaka.com/showtopic-8594143.aspx

http://bbs.ikaka.com/showtopic-8594167.aspx

http://bbs.ikaka.com/showtopic-8594156.aspx

签到


http://bbs.ikaka.com/showtopic-8594203.aspx

http://bbs.ikaka.com/showtopic-8594485.aspx

http://bbs.ikaka.com/showtopic-8594497.aspx

http://bbs.ikaka.com/showtopic-8594509.aspx

签到



http://bbs.ikaka.com/showtopic-8594512.aspx

http://bbs.ikaka.com/showtopic-8594515.aspx

http://bbs.ikaka.com/showtopic-8594558.aspx

http://bbs.ikaka.com/showtopic-8594626.aspx

http://bbs.ikaka.com/showtopic-8594631.aspx

http://bbs.ikaka.com/showtopic-8594736.aspx

http://bbs.ikaka.com/showtopic-8594750.aspx

签到


http://bbs.ikaka.com/showtopic-8595067.aspx

http://bbs.ikaka.com/showtopic-8594911.aspx

http://bbs.ikaka.com/showtopic-8594997.aspx

http://bbs.ikaka.com/showtopic-8595058.aspx

http://bbs.ikaka.com/showtopic-8595063.aspx

http://bbs.ikaka.com/showtopic-8595071.aspx

http://bbs.ikaka.com/showtopic-8595066.aspx

签到



http://bbs.ikaka.com/showtopic-8595289.aspx

签到



http://bbs.ikaka.com/showtopic-8595413.aspx

http://bbs.ikaka.com/showtopic-8595450.aspx

签到



http://bbs.ikaka.com/showtopic-8595668.aspx

http://bbs.ikaka.com/showtopic-8595955.aspx

签到



http://bbs.ikaka.com/showtopic-8596284.aspx

http://bbs.ikaka.com/showtopic-8596091.aspx