windows无止境地发送数据包，这是为什么？

lemonboy

我的windows无止境地发送数据包，这是为什么？
弄地我的路由器也经常需要重起，各位帮我想个办法吧？！
指望杀毒软件似乎是行不通了。

lemonboy

继续添加信息！

lemonboy

为什么看的人多，说的人少呢？

33to9

用autorun看啊

deeperpurple

用System Repair Engineer 的智能扫描，发个Log上来；
spooler、alg这样的服务可以关掉；
在80端口监听，可能有个木马；

把所有与网络相关的程序关掉，用Wireshark抓包看看；

lemonboy

原帖由 deeperpurple 于 2007-4-21 21:30 发表
用System Repair Engineer 的智能扫描，发个Log上来；
spooler、alg这样的服务可以关掉；
在80端口监听，可能有个木马；

把所有与网络相关的程序关掉，用Wireshark抓包看看；

这是我的扫描结果，请帮我分析一下。谢谢了

1. 
   
2. 
   
3. 2007-04-22,01:21:33
   
4. 
   
5. System Repair Engineer 2.4.12.806
   
6. Smallfrogs (http://www.KZTechs.com)
   
7. 
   
8. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   
9. 
   
10. 以下内容被选中：
    
11.     所有的启动项目（包括注册表、启动文件夹、服务等）
    
12.     浏览器加载项
    
13.     正在运行的进程（包括进程模块信息）
    
14.     文件关联
    
15.     Winsock 提供者
    
16.     Autorun.inf
    
17.     HOSTS 文件
    
18. 
    
19. 
    
20. 启动项目
    
21. 注册表
    
22. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    
23.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    
24.     <DAEMON Tools><"e:\Program Files\DAEMON Tools\daemon.exe" -lang 1033>  [(Verified)DAEMON Tools Code Signing Services]
    
25. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    
26.     <load><>  [N/A]
    
27. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
28.     <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    
29.     <RavTask><"e:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    
30.     <RfwMain><"e:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    
31.     <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
32.     <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [(Verified)Microsoft Windows Publisher]
    
33.     <SunJavaUpdateSched><E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe>  [Sun Microsystems, Inc.]
    
34.     <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    
35.     <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    
36.     <IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log>  [Microsoft Corporation]
    
37.     <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    
38.     <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    
39.     <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
    
40.     <ATIModeChange><Ati2mdxx.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
41.     <AGRSMMSG><AGRSMMSG.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
42. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
43.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    
44.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    
45. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    
46.     <AppInit_DLLs><>  [N/A]
    
47. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
48.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    
49. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    
50.     <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    
51. 
    
52. ==================================
    
53. 启动文件夹
    
54. [腾讯QQ]
    
55.   <C:\Documents and Settings\HollyLee\「开始」菜单\程序\启动\腾讯QQ.lnk --> E:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>
    
56. 
    
57. ==================================
    
58. 服务
    
59. [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
    
60.   <C:\WINDOWS\system32\Ati2evxx.exe><>
    
61. [Human Interface Device Access / HidServ][Stopped/Disabled]
    
62.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    
63. [Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
    
64.   <e:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
    
65. [Rising Personal Firewall Service / RfwService][Running/Auto Start]
    
66.   <e:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
    
67. [Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
    
68.   <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
    
69. [Rising Process Communication Center / RsCCenter][Running/Auto Start]
    
70.   <"e:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
    
71. [Rising RealTime Monitor / RsRavMon][Running/Auto Start]
    
72.   <"E:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
    
73. 
    
74. ==================================
    
75. 驱动程序
    
76. [SENS LT56ADW Modem / AgereSoftModem][Running/Manual Start]
    
77.   <system32\DRIVERS\AGRSM.sys><Agere Systems>
    
78. [ati2mtag / ati2mtag][Running/Manual Start]
    
79.   <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
    
80. [Rising TDI Base Driver / BaseTDI][Running/Auto Start]
    
81.   <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
    
82. [Cirrus Logic WDM Audio Codec Driver / cs429x][Running/Manual Start]
    
83.   <system32\drivers\cwawdm.sys><Cirrus Logic, Inc.>
    
84. [Intel(R) PRO Adapter Driver / E100B][Running/Manual Start]
    
85.   <system32\DRIVERS\e100b325.sys><Intel Corporation>
    
86. [ExpScaner / ExpScaner][Running/Auto Start]
    
87.   <\??\E:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
    
88. [HookCont / HookCont][Running/Auto Start]
    
89.   <\??\E:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
    
90. [HookReg / HookReg][Running/Auto Start]
    
91.   <\??\E:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
    
92. [HookSys / HookSys][Running/Auto Start]
    
93.   <\??\E:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
    
94. [HookUrl / HookUrl][Running/Auto Start]
    
95.   <\??\e:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
    
96. [MEMSCAN / MEMSCAN][Running/Auto Start]
    
97.   <\??\E:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
    
98. [mProcRs / mProcRs][Running/Auto Start]
    
99.   <\??\e:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
    
100. [NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
     
101.   <system32\drivers\npf.sys><Politecnico di Torino>
     
102. [npkcrypt / npkcrypt][Running/Auto Start]
     
103.   <\??\e:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
     
104. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     
105.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     
106. [PxHelp20 / PxHelp20][Running/Boot Start]
     
107.   <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
     
108. [RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
     
109.   <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
     
110. [RsFwDrv / RsFwDrv][Running/Auto Start]
     
111.   <\??\e:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
     
112. [RsNTGDI / RsNTGDI][Running/Boot Start]
     
113.   <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
     
114. [RSPPSYS / RSPPSYS][Running/Auto Start]
     
115.   <\??\E:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
     
116. [Secdrv / Secdrv][Stopped/Manual Start]
     
117.   <system32\DRIVERS\secdrv.sys><N/A>
     
118. [sptd / sptd][Running/Boot Start]
     
119.   <\SystemRoot\System32\Drivers\sptd.sys><N/A>
     
120. [Synaptics TouchPad Driver / SynTP][Running/Manual Start]
     
121.   <system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
     
122. 
     
123. ==================================
     
124. 浏览器加载项
     
125. [Thunder Browser Helper]
     
126.   {54EBD539-9BC1-480B-966A-843A333CA162} <e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
     
127. [QQBrowserHelperObject Class]
     
128.   {54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
     
129. [BandIE Class]
     
130.   {77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, N/A>
     
131. [Windows Live Sign-in Helper]
     
132.   {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
     
133. [Java Plug-in 1.5.0_01]
     
134.   {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <E:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll, Sun Microsystems, Inc.>
     
135. [启动迅雷5]
     
136.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <e:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
     
137. [浩方对战平台]
     
138.   {0A155D3C-68E2-4215-A47A-E800A446447A} <E:\Program Files\HFGameOPT\GameClient.exe, 上海浩方在线信息技术有限公司>
     
139. [信息检索(&R)]
     
140.   {92780B25-18CC-41C8-B9BE-3C9C571A8263} <E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
     
141. [QQ]
     
142.   {c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
     
143. [QQIEFloatBarCfgCmd Class]
     
144.   {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
     
145. [Messenger]
     
146.   {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
     
147. [百度超级搜霸]
     
148.   {B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, N/A>
     
149. [Edit Class]
     
150.   {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
     
151. [Java Plug-in 1.5.0_01]
     
152.   {8AD9C840-044E-11D1-B3E9-00805F499D93} <E:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll, Sun Microsystems, Inc.>
     
153. [Java Plug-in 1.5.0_01]
     
154.   {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} <E:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll, Sun Microsystems, Inc.>
     
155. [Shockwave Flash Object]
     
156.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
     
157. [Thunder Browser Helper]
     
158.   {54EBD539-9BC1-480B-966A-843A333CA162} <e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
     
159. [QQBrowserHelperObject Class]
     
160.   {54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
     
161. [Active Desktop Mover]
     
162.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     
163. [BandIE Class]
     
164.   {77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, N/A>
     
165. [Thunder Browser Helper]
     
166.   {889D2FEB-5411-4565-8998-1DD2C5261283} <e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
     
167. [Windows Live Sign-in Helper]
     
168.   {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
     
169. [百度超级搜霸]
     
170.   {B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, N/A>
     
171. [Shockwave Flash Object]
     
172.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
     
173. [&使用迅雷下载]
     
174.   <e:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
     
175. [&使用迅雷下载全部链接]
     
176.   <e:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
     
177. [上传到QQ网络硬盘]
     
178.   <E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
     
179. [导出到 Microsoft Office Excel(&X)]
     
180.   <res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
     
181. [添加到QQ自定义面板]
     
182.   <E:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
     
183. [添加到QQ表情]
     
184.   <E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     
185. [用QQ彩信发送该图片]
     
186.   <E:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
     
187. 
     
188. ==================================
     
189. 正在运行的进程
     
190. [PID: 608][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
191. [PID: 692][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
192. [PID: 716][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
193.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
194. [PID: 760][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
195. [PID: 772][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
196. [PID: 936][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
197. [PID: 1004][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
198. [PID: 1116][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
199. [PID: 512][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     
200.     [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
     
201.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
202.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
203. [PID: 1220][e:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
     
204.     [e:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
     
205.     [e:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
     
206.     [e:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
     
207.     [e:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
     
208.     [e:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
     
209.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
210. [PID: 244][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe]  [Synaptics, Inc., 7.2.9 03Jan03]
     
211.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
212. [PID: 260][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  [Synaptics, Inc., 7.2.9 03Jan03]
     
213.     [C:\WINDOWS\system32\SynTPAPI.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
214.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
215. [PID: 264][E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe]  [Sun Microsystems, Inc., 1.5.0.10]
     
216. [PID: 1948][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.4035]
     
217.     [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.4035]
     
218.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
219.     [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.4035]
     
220. [PID: 824][C:\WINDOWS\AGRSMMSG.exe]  [Agere Systems, 2.1.18 2.1.18 09/11/2002 17:23:56]
     
221.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
222. [PID: 1240][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
223.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
224. [PID: 1480][E:\Program Files\DAEMON Tools\daemon.exe]  [DT Soft Ltd., 4.08.0.0]
     
225.     [e:\Program Files\DAEMON Tools\daemon.dll]  [DT Soft Ltd., 4.08.0.0]
     
226.     [e:\Program Files\DAEMON Tools\PFCTOC.DLL]  [Padus(R), Inc., 1, 0, 0, 12]
     
227.     [e:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll]  [, 1.1.0.0]
     
228.     [e:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll]  [GENERIC, 1.10.0.0]
     
229.     [e:\Program Files\DAEMON Tools\Plugins\Images\cuemount.dll]  [DT Soft Ltd., 1.01.0.0]
     
230.     [e:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll]  [DT Soft Ltd., 1.18.0.0]
     
231.     [e:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll]  [DT Soft Ltd., 1.12.0.0]
     
232.     [e:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll]  [GENERIC, 1.01.0.0]
     
233.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
234. [PID: 2900][E:\Program Files\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 5, 9, 80]
     
235.     [E:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
     
236.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
237.     [C:\WINDOWS\system32\odbcbcp.dll]  [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)]
     
238.     [e:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
     
239.     [E:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
     
240.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
241.     [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
     
242. [PID: 2648][e:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
     
243.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
244.     [C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll]  [Microsoft Corporation, 8.1.0178.00]
     
245. [PID: 3248][C:\DOCUME~1\HollyLee\LOCALS~1\Temp\Rar$EX01.085\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
     
246.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.2.9 03Jan03]
     
247. 
     
248. ==================================
     
249. 文件关联
     
250. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
251. .EXE  OK. ["%1" %*]
     
252. .COM  OK. ["%1" %*]
     
253. .PIF  OK. ["%1" %*]
     
254. .REG  OK. [regedit.exe "%1"]
     
255. .BAT  OK. ["%1" %*]
     
256. .SCR  OK. ["%1" /S]
     
257. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     
258. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     
259. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
260. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
261. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
262. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
263. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     
264. 
     
265. ==================================
     
266. Winsock 提供者
     
267. N/A
     
268. 
     
269. ==================================
     
270. Autorun.inf
     
271. N/A
     
272. 
     
273. ==================================
     
274. HOSTS 文件
     
275. 127.0.0.1       localhost
     
276. 
     
277. ==================================
     
278. API HOOK
     
279. N/A
     
280. 
     
281. ==================================
     
282. 隐藏进程
     
283. N/A
     
284. 
     
285. ==================================
     
286. 
     
287. 
     

复制代码

wildlily980

你有apache，不停地发送数据不了很正常吗？你从哪里发现不正常？
其实你可以把所有的服务都停掉，然后再看看哪个端口连接着，那它就十分可疑了。

一阳子

猛发包这家伙就是我同学,他好久以前用过apache,很长一段时间都没有用了.都不曾这样无休止地发包.最近才开始,最近我们局域网都变得很慢,怀疑就是因为他机器不停发包得原因.
然后前几天他把机器共享打开,另外一个同学上传文件给他,之后上传文件的这位也开始猛发包了...

不用马甲

断开所有网络连接的程序
用netstat -ano
查看还在连接网络的进程号，然后打载任务管理器，在查看中选择是PID列，就可以找了具体的可疑程序了

wingjing

很明显是病毒..
只是通过LOG没有发现很可疑的进程
可以通过icesword查看一下进程和网络连接..