【求助】Internet出现怪现象

freundlich

问题一：Sent packets 比 received packets多，但我并没上传任何东西。
问题二：我开着电脑六分钟没去动它，它却sent了18,596 packets，received 10,565 packets. 这到底是什么问题？

我用Ad-aware 6和Spybot - search and destroy去掉了adware和spyware也解决不了。请帮帮我吧。

guyhard

可能你开了auto windows  update! 你check check 看！ 你是用什么windows的?

应该是用2K pro吧.
如果什么都没有做都有这种问题,就去dos command里跑netstat. 看看你的computer连去哪里.如果是windows update或antivirus update就OK.不然的话,有可能中spyware还是被hack了.

lion_o

这是什么意思呢？

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\home>netstat

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    home:1045              d-210-171-85-225.d-cable.katch.ne.jp:1392  ESTAB
LISHED
  TCP    home:1053              24-193-209-25.nyc.rr.com:3912  ESTABLISHED
  TCP    home:1183              218.1.73.173:http      ESTABLISHED
  TCP    home:1188              216.239.53.104:http    ESTABLISHED
  TCP    home:1217              219.133.39.29:http     LAST_ACK
  TCP    home:1220              144.133.236.25:1214    ESTABLISHED
  TCP    home:1223              202.133.98.132:http    TIME_WAIT
  TCP    home:1224              202.133.98.132:http    TIME_WAIT
  TCP    home:1225              202.133.98.132:http    TIME_WAIT
  TCP    home:1227              http7-1.us4.outblaze.com:http  TIME_WAIT
  TCP    home:1237              http7-1.us4.outblaze.com:http  TIME_WAIT
  TCP    home:1251              203.106.50.11:http     ESTABLISHED
  TCP    home:1254              img1.us4.outblaze.com:http  CLOSE_WAIT
  TCP    home:1256              203.106.50.33:http     ESTABLISHED
  TCP    home:1258              203-173-58-176.dyn.iinet.net.au:1665  SYN_SENT

freundlich

auto windows update的setting在哪里? 我找不到。

jasonmun

freundlich 于 18-11-2004 12:11 AM  说 :
auto windows update的setting在哪里? 我找不到。

XP SP1
======
Control Panel -> Automatic Updates
or
My Computer (Right Click) -> Properties -> Automatic Updates

lion_o 于 17-11-2004 09:21 PM  说 :
这是什么意思呢？

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\home>netstat

Active Connections

  Proto  Local Address     ...

楼上的请问你是个人用户还是公司的电脑？

freundlich

果然是automatic updates的问题，谢谢。

lou_wai

怎么分析这些Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    heartbrokenboy:3015    222.83.131.237:12365   FIN_WAIT_1
  TCP    heartbrokenboy:3017    218-164-66-58.dynamic.hinet.net:1881  ESTABLISHE
D
  TCP    heartbrokenboy:3024    n219077048215.netvigator.com:1881  ESTABLISHED
  TCP    heartbrokenboy:3036    220.173.154.134:9652   ESTABLISHED
  TCP    heartbrokenboy:3038    218.19.101.148:8665    LAST_ACK
  TCP    heartbrokenboy:3039    bb219-74-35-112.singnet.com.sg:18581  ESTABLISHE
D
  TCP    heartbrokenboy:3040    219.128.39.15:24415    LAST_ACK
  TCP    heartbrokenboy:3050    209.161.235.39:23641   ESTABLISHED
  TCP    heartbrokenboy:3053    156.26.119.224:16432   ESTABLISHED
  TCP    heartbrokenboy:3056    218.208.238.192:8458   TIME_WAIT
  TCP    heartbrokenboy:3057    219.135.5.215:16881    LAST_ACK
  TCP    heartbrokenboy:3061    vaiscopycat.plus.com:8259  LAST_ACK
  TCP    heartbrokenboy:3072    adsl2.dyn227.pacific.net.sg:9239  TIME_WAIT
  TCP    heartbrokenboy:3091    220.188.192.111:1884   ESTABLISHED
  TCP    heartbrokenboy:3096    218.97.238.247:8891    ESTABLISHED
  TCP    heartbrokenboy:3097    218.13.157.146:16881   LAST_ACK
  TCP    heartbrokenboy:3100    61.145.33.19:16881     FIN_WAIT_1
  TCP    heartbrokenboy:3101    S01060004e2a68993.vc.shawcable.net:6957  ESTABLI
SHED
  TCP    heartbrokenboy:3103    200.121.88.12:23643    LAST_ACK
  TCP    heartbrokenboy:3104    adsl-63-204-133-233.dsl.snfc21.pacbell.net:10684
  FIN_WAIT_1
  TCP    heartbrokenboy:3105    210006225031.ctinets.com:1881  ESTABLISHED
  TCP    heartbrokenboy:3110    219.129.225.134:32234  ESTABLISHED
  TCP    heartbrokenboy:3132    63.150.131.34:80       ESTABLISHED
  TCP    heartbrokenboy:3136    n219077058104.netvigator.com:12357  ESTABLISHED
  TCP    heartbrokenboy:3143    219.128.41.43:19008    ESTABLISHED
  TCP    heartbrokenboy:3147    220.187.224.182:8882   ESTABLISHED
  TCP    heartbrokenboy:3149    218.18.155.23:24182    LAST_ACK
  TCP    heartbrokenboy:3153    210006067004.ctinets.com:1881  ESTABLISHED
  TCP    heartbrokenboy:3156    221.216.105.40:23690   ESTABLISHED
  TCP    heartbrokenboy:3157    209.161.235.39:23641   ESTABLISHED
  TCP    heartbrokenboy:3158    218.191.216.120:25808  ESTABLISHED
  TCP    heartbrokenboy:3159    pcd561026.netvigator.com:11465  ESTABLISHED
  TCP    heartbrokenboy:3167    221.12.20.32:17755     ESTABLISHED
  TCP    heartbrokenboy:3170    218.5.72.126:8082      LAST_ACK
  TCP    heartbrokenboy:3172    219.95.209.159:7219    ESTABLISHED
  TCP    heartbrokenboy:3179    24-193-158-62.nyc.rr.com:31561  ESTABLISHED
  TCP    heartbrokenboy:3183    61-70-169-253.adsl.static.giga.net.tw:16881  LAS
T_ACK
  TCP    heartbrokenboy:3188    adsl2.dyn227.pacific.net.sg:9845  ESTABLISHED
  TCP    heartbrokenboy:3191    218.79.2.57:6001       ESTABLISHED
  TCP    heartbrokenboy:3194    218.16.142.119:10791   LAST_ACK
  TCP    heartbrokenboy:3198    63.150.131.34:80       ESTABLISHED
  TCP    heartbrokenboy:3199    63.150.131.34:80       ESTABLISHED
  TCP    heartbrokenboy:3202    c10-ad-xw-lb.cnet.com:80  ESTABLISHED
  TCP    heartbrokenboy:3203    c10-ad-xw-lb.cnet.com:80  ESTABLISHED
  TCP    heartbrokenboy:3214    219.131.6.191:8812     ESTABLISHED
  TCP    heartbrokenboy:3216    pcd648185.netvigator.com:15381  ESTABLISHED
  TCP    heartbrokenboy:3228    S0106000cf1a2008e.vc.shawcable.net:21673  ESTABL
ISHED
  TCP    heartbrokenboy:3230    adsl-63-204-133-233.dsl.snfc21.pacbell.net:10684
  ESTABLISHED
  TCP    heartbrokenboy:3237    219.136.150.141:8884   ESTABLISHED
  TCP    heartbrokenboy:3238    c-67-169-61-64.client.comcast.net:18921  ESTABLI
SHED
  TCP    heartbrokenboy:3243    158-229.dorm.ncu.edu.tw:16881  ESTABLISHED
  TCP    heartbrokenboy:3260    c529cf1e5.cable.wanadoo.nl:12623  ESTABLISHED
  TCP    heartbrokenboy:3262    219.128.247.116:17344  LAST_ACK
  TCP    heartbrokenboy:3264    61-228-220-143.dynamic.hinet.net:14359  ESTABLIS
HED
  TCP    heartbrokenboy:3278    63.150.131.34:80       ESTABLISHED
  TCP    heartbrokenboy:3292    218-175-99-189.dynamic.hinet.net:8094  LAST_ACK
  TCP    heartbrokenboy:3298    d154-5-17-178.bchsia.telus.net:19270  ESTABLISHE
D
  TCP    heartbrokenboy:3301    210006034029.ctinets.com:12942  ESTABLISHED
  TCP    heartbrokenboy:3306    pcd431079.netvigator.com:6346  ESTABLISHED
  TCP    heartbrokenboy:3307    219.129.225.134:32234  ESTABLISHED
  TCP    heartbrokenboy:3310    211.96.198.104:1160    ESTABLISHED
  TCP    heartbrokenboy:3311    219.135.5.215:16881    LAST_ACK
  TCP    heartbrokenboy:3318    adsl-68-253-211-127.dsl.emhril.ameritech.net:939
3  ESTABLISHED
  TCP    heartbrokenboy:3326    221.232.96.14:1882     ESTABLISHED
  TCP    heartbrokenboy:3337    218.79.168.76:16881    ESTABLISHED
  TCP    heartbrokenboy:3341    61.144.143.237:14024   ESTABLISHED
  TCP    heartbrokenboy:3364    n219078083061.netvigator.com:16881  ESTABLISHED
  TCP    heartbrokenboy:3368    24-193-204-94.nyc.rr.com:8888  ESTABLISHED
  TCP    heartbrokenboy:3376    219.130.184.64:16881   ESTABLISHED
  TCP    heartbrokenboy:3378    modemcable247.164-201-24.mc.videotron.ca:6884  E
STABLISHED
  TCP    heartbrokenboy:3384    adsl2.dyn227.pacific.net.sg:9239  ESTABLISHED
  TCP    heartbrokenboy:3386    219.137.107.108:16881  LAST_ACK
  TCP    heartbrokenboy:3395    218.13.18.249:1885     FIN_WAIT_2
  TCP    heartbrokenboy:3398    pcd648185.netvigator.com:15381  LAST_ACK
  TCP    heartbrokenboy:3399    218.191.216.120:25808  ESTABLISHED
  TCP    heartbrokenboy:3401    221.125.8.247:6882     ESTABLISHED
  TCP    heartbrokenboy:3413    218.19.215.166:12144   ESTABLISHED
  TCP    heartbrokenboy:3414    219.129.197.117:6881   ESTABLISHED
  TCP    heartbrokenboy:3418    219.129.192.166:10000  ESTABLISHED
  TCP    heartbrokenboy:3423    n219078182003.netvigator.com:8883  ESTABLISHED
  TCP    heartbrokenboy:3429    219.157.11.109:8080    LAST_ACK
  TCP    heartbrokenboy:3431    host-24-225-241-108.patmedia.net:14537  ESTABLIS
HED
  TCP    heartbrokenboy:3434    p27-134.nhust.edu.tw:13815  SYN_SENT
  TCP    heartbrokenboy:3437    219.157.11.109:8080    ESTABLISHED
  TCP    heartbrokenboy:3439    061093186041.ctinets.com:1885  ESTABLISHED
  TCP    heartbrokenboy:3440    219.95.249.239:6881    ESTABLISHED
  TCP    heartbrokenboy:3441    219.137.51.250:9551    ESTABLISHED
  TCP    heartbrokenboy:3443    61.144.19.86:15482     SYN_SENT
  TCP    heartbrokenboy:3446    bb220-255-106-118.singnet.com.sg:14791  SYN_SENT

  TCP    heartbrokenboy:3448    n218250016141.netvigator.com:6881  SYN_SENT
  TCP    heartbrokenboy:3449    218.13.207.248:16881   SYN_SENT
  TCP    heartbrokenboy:3450    61.145.205.61:17529    SYN_SENT
  TCP    heartbrokenboy:3451    61.144.99.253:16881    SYN_SENT
  TCP    heartbrokenboy:3452    222.217.24.108:15726   SYN_SENT
  TCP    heartbrokenboy:3453    ip68-102-221-15.ks.ok.cox.net:16881  ESTABLISHED
希望有人可以告诉我，谢谢！

Eric_Joe

你在那里找来这样多IP的?

whatkao

如果是windows xp 的话,update SP2就可以了,
但是是win98的话,要怎么做???(本人用过杀SPYWARE,Antivirus,trojan等软件也不能解决问题)
如果是电脑的internet explorer,一直popup up其他的网页的话要怎么解决???

[ Last edited by whatkao on 24-11-2004 at 07:57 PM ]

Sent packets 比 received packets多，这种情况也有可能是种了w32/sdbot.worm病毒。我最近常种这个一上网就中。

[ Last edited by 小女人下午茶 on 25-11-2004 at 02:17 AM ]