电脑网络间歇性断网

显示全部楼层 · 发表于 2011-8-11 09:11:32

本帖最后由 marcade 于 2011-8-11 20:01 编辑

电脑是在局域网中的一台，整个网络装了NETSCREEN来限速，但我的电脑一直间歇性断网，请各位根据以下信息帮忙看一下原因。谢谢！怀疑自己的电脑被从后门装了什么软件了，一直用COMODO+avast+360安全卫士，以前comodo还能显示入侵的IP并阻止，但现在开机后，COMODO显示“无法初始化”，AVAST打小红叉，只有停用网络连接，这两个程序才能正常开启运作。

关机时显示“其他用户登录到这台计算机”。

间歇性断网时的NETSCREEN日志如下：
Date/Time source    address/port destination  address/port translated source address/port translated destination address/port service duration bytes sent bytes received
2011-8-11 9:52 192.168.0.102:1575 199.66.201.21:4448 58.34.150.105:1064 199.66.201.21:4448 TCP PORT 4448 21 sec. 82 0
2011-8-11 9:52 192.168.0.102:1532 199.66.201.21:4447 58.34.150.105:2978 199.66.201.21:4447 UDP PORT 4447 60 sec. 91 56
2011-8-11 9:52 192.168.0.102:1531 199.66.201.21:4447 58.34.150.105:2976 199.66.201.21:4447 UDP PORT 4447 61 sec. 91 56
2011-8-11 9:52 192.168.0.102:57126 202.96.209.133:53 58.34.150.105:1075 202.96.209.133:53 DNS 2 sec. 73 212
2011-8-11 9:52 192.168.0.102:57038 202.96.209.133:53 58.34.150.105:1113 202.96.209.133:53 DNS 4 sec. 73 212
2011-8-11 9:52 192.168.0.102:1530 199.66.201.21:4447 58.34.150.105:2974 199.66.201.21:4447 UDP PORT 4447 59 sec. 91 56
2011-8-11 9:52 192.168.0.102:1529 199.66.201.21:4447 58.34.150.105:2973 199.66.201.21:4447 UDP PORT 4447 59 sec. 91 56
2011-8-11 9:52 192.168.0.102:1527 199.66.201.21:4447 58.34.150.105:2971 199.66.201.21:4447 UDP PORT 4447 60 sec. 91 56
2011-8-11 9:52 192.168.0.102:60591 202.96.209.133:53 58.34.150.105:1107 202.96.209.133:53 DNS 2 sec. 73 212
2011-8-11 9:52 192.168.0.102:1525 199.66.201.21:4447 58.34.150.105:2969 199.66.201.21:4447 UDP PORT 4447 60 sec. 91 56
2011-8-11 9:52 192.168.0.102:64675 202.96.209.133:53 58.34.150.105:1053 202.96.209.133:53 DNS 2 sec. 79 208
2011-8-11 9:52 192.168.0.102:1520 218.93.127.217:80 58.34.150.105:2961 218.93.127.217:80 HTTP 66 sec. 681 402
2011-8-11 9:52 192.168.0.102:1524 199.66.201.21:4447 58.34.150.105:2967 199.66.201.21:4447 UDP PORT 4447 61 sec. 91 56
2011-8-11 9:52 192.168.0.102:1526 199.66.201.21:4447 58.34.150.105:2970 199.66.201.21:4447 UDP PORT 4447 60 sec. 91 56
2011-8-11 9:52 192.168.0.102:1528 199.66.201.21:4447 58.34.150.105:2972 199.66.201.21:4447 UDP PORT 4447 59 sec. 91 56
2011-8-11 9:52 192.168.0.102:1521 218.93.127.217:80 58.34.150.105:2965 218.93.127.217:80 HTTP 63 sec. 683 402

注册表信息如下：

SRENG日志如下：

netstat命令内容如下：
Microsoft Windows XP [版本 5.1.2600]
(C) 版权所有 1985-2001 Microsoft Corp.
C:\Documents and Settings\Administrator>arp -a
Interface: 192.168.0.102 --- 0x20003
  Internet Address    Physical Address    Type
  192.168.0.1          00-10-db-1a-2b-52    dynamic
C:\Documents and Settings\Administrator>netstat -ano
Active Connections
  Proto  Local Address       Foreign Address       State          PID
  TCP 0.0.0.0:135          0.0.0.0:0             LISTENING    860
  TCP 0.0.0.0:10102       0.0.0.0:0             LISTENING    696
  TCP 127.0.0.1:1031       0.0.0.0:0             LISTENING    1836
  TCP 127.0.0.1:1059       127.0.0.1:1060       ESTABLISHED    2500
  TCP 127.0.0.1:1060       127.0.0.1:1059       ESTABLISHED    2500
  TCP 127.0.0.1:1066       127.0.0.1:1067       ESTABLISHED    2500
  TCP 127.0.0.1:1067       127.0.0.1:1066       ESTABLISHED    2500
  TCP 127.0.0.1:3238       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3240       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3324       127.0.0.1:12080       FIN_WAIT_2    2500
  TCP 127.0.0.1:3390       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3433       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3439       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3442       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3456       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3473       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3474       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3481       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3486       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3491       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3495       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3497       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3501       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3505       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3510       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3512       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3518       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3520       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3524       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3530       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3538       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3541       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3544       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3545       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3548       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3554       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3557       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3562       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3569       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3570       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3573       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3580       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3584       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3586       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3587       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3592       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3594       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3602       127.0.0.1:12080       TIME_WAIT    0
  TCP 127.0.0.1:3607       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:3676       127.0.0.1:12080       ESTABLISHED    2500
  TCP 127.0.0.1:12025       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12080       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12080       127.0.0.1:1502       CLOSE_WAIT    1320
  TCP 127.0.0.1:12080       127.0.0.1:3324       CLOSE_WAIT    1320
  TCP 127.0.0.1:12080       127.0.0.1:3406       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3425       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3469       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3477       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3479       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3483       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3503       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3522       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3540       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3544       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3548       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3549       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3550       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3552       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3554       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3557       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3559       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3562       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3565       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3566       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3568       TIME_WAIT    0
  TCP 127.0.0.1:12080       127.0.0.1:3569       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3570       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3573       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3586       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3587       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3592       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3594       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3607       ESTABLISHED    1320
  TCP 127.0.0.1:12080       127.0.0.1:3676       ESTABLISHED    1320
  TCP 127.0.0.1:12110       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12119       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12143       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12465       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12563       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12993       0.0.0.0:0             LISTENING    1320
  TCP 127.0.0.1:12995       0.0.0.0:0             LISTENING    1320
  TCP 192.168.0.102:2909    114.80.208.121:80    ESTABLISHED    1320
  TCP 192.168.0.102:2924    114.80.208.121:80    ESTABLISHED    1320
  TCP 192.168.0.102:2951    114.80.208.121:80    ESTABLISHED    1320
  TCP 192.168.0.102:2961    114.80.208.121:80    ESTABLISHED    1320
  TCP 192.168.0.102:3059    74.82.162.164:80    LAST_ACK       1320
  TCP 192.168.0.102:3186    114.80.0.242:80       LAST_ACK       1320
  TCP 192.168.0.102:3222    114.80.0.251:80       LAST_ACK       1320
  TCP 192.168.0.102:3279    114.80.182.240:80    LAST_ACK       1320
  TCP 192.168.0.102:3325    110.75.2.12:80       ESTABLISHED    1320
  TCP 192.168.0.102:3383    110.75.12.7:80       FIN_WAIT_1    1320
  TCP 192.168.0.102:3412    110.75.27.31:80       FIN_WAIT_1    1320
  TCP 192.168.0.102:3482    114.80.182.240:80    TIME_WAIT    0
  TCP 192.168.0.102:3487    122.225.34.240:80    TIME_WAIT    0
  TCP 192.168.0.102:3496    114.80.0.250:80       TIME_WAIT    0
  TCP 192.168.0.102:3502    114.80.0.250:80       TIME_WAIT    0
  TCP 192.168.0.102:3546    114.80.0.242:80       CLOSE_WAIT    1320
  TCP 192.168.0.102:3547    110.75.180.197:80    TIME_WAIT    0
  TCP 192.168.0.102:3585    110.75.2.12:80       TIME_WAIT    0
  TCP 192.168.0.102:3597    122.225.34.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3601    114.80.182.240:80    LAST_ACK       1320
  TCP 192.168.0.102:3605    122.225.34.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3614    114.80.182.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3615    122.225.34.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3616    122.225.34.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3617    114.80.182.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3623    116.225.22.18:8090    CLOSE_WAIT    696
  TCP 192.168.0.102:3624    116.235.46.220:8090 FIN_WAIT_1    696
  TCP 192.168.0.102:3626    61.172.179.130:8090 CLOSE_WAIT    696
  TCP 192.168.0.102:3633    58.218.203.12:80    TIME_WAIT    0
  TCP 192.168.0.102:3634    114.80.182.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3636    122.225.34.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3638    122.226.213.170:80    CLOSE_WAIT    696
  TCP 192.168.0.102:3640    123.172.175.16:8090 CLOSE_WAIT    696
  TCP 192.168.0.102:3659    122.225.34.240:80    CLOSE_WAIT    1320
  TCP 192.168.0.102:3665    113.73.233.41:8090    SYN_SENT       696
  TCP 192.168.0.102:3666    116.238.245.237:8090 SYN_SENT       696
  TCP 192.168.0.102:3667    183.18.33.62:8090    SYN_SENT       696
  TCP 192.168.0.102:3668    1.81.172.131:8090    SYN_SENT       696
  TCP 192.168.0.102:3669    113.143.60.241:8090 SYN_SENT       696
  TCP 192.168.0.102:3670    223.244.80.41:8090    SYN_SENT       696
  TCP 192.168.0.102:3671    116.235.154.253:8090 SYN_SENT       696
  TCP 192.168.0.102:3672    122.225.34.240:80    SYN_SENT       1320
  TCP 192.168.0.102:3673    113.102.231.214:8090 SYN_SENT       696
  TCP 192.168.0.102:3674    114.80.0.250:80       SYN_SENT       1320
  TCP 192.168.0.102:3675    114.80.182.240:80    SYN_SENT       1320
  TCP 192.168.0.102:3677    192.168.0.1:80       SYN_SENT       1320
  UDP 0.0.0.0:1036          *:*                                  1992
  UDP 0.0.0.0:1070          *:*                                  2500
  UDP 0.0.0.0:3600          *:*                                  1992
  UDP 0.0.0.0:3601          *:*                                  696
  UDP 0.0.0.0:9200          *:*                                  696
  UDP 0.0.0.0:10102       *:*                                  696
  UDP 127.0.0.1:123       *:*                                  956
  UDP 127.0.0.1:1028       *:*                                  1992
  UDP 127.0.0.1:1061       *:*                                  956
  UDP 127.0.0.1:1900       *:*                                  780
  UDP 192.168.0.102:123    *:*                                  956
  UDP 192.168.0.102:1900    *:*                                  780

没装任何P2P软件，管理局域网的NETSCREEN的程序员在网关上把每台电脑都限速了，所以这个局域网里一般没什么人下载过多的，但有时候有几台电脑会同时间歇性断网，（尝试过局域网里所有电脑关机，这几台有问题的电脑依次单独开机一段时间，也会出现间歇性断网，所以觉得是这几台电脑本身被植入了一些木马啊什么的吧，但就是查不出。）。

事件查看器日志如下：

显示全部楼层 · 发表于 2011-8-11 09:49:12

lz好专业的数据，我只知道间歇性断网与防火墙、路由器、arp病毒有关，木法帮助你解决，帮你加加人气，希望后来者解决

显示全部楼层 · 发表于 2011-8-11 10:41:50

怎么开了这么多端口的？127.0.0.1:12080 这个是不是运行了什么软件？

显示全部楼层 · 发表于 2011-8-11 10:44:32

楼主是不是装了什么软件以后才开始间歇性断网的，是有规律的还是没有规律

显示全部楼层 · 发表于 2011-8-11 11:28:32

去掉网络限制看看。或者有什么P2P软件导致网络流量大断网

显示全部楼层 · 发表于 2011-8-11 15:59:00

查了一下NETSCREEN日志，断网时没有大流量。

显示全部楼层 · 发表于 2011-8-11 17:02:01

看了楼主的情况估计是P2P攻击造成的。被别人P2P控制了，我以前也是同样的情况哦。用防火墙软件试试。

显示全部楼层 · 发表于 2011-8-11 17:40:49

要是P2P控制，在多特见过反P2P的，没用过不知道效果，可以试下

显示全部楼层 · 发表于 2011-8-11 19:52:32

本帖最后由 marcade 于 2011-8-12 06:55 编辑

局域网里只有我一台电脑开着的时候也是间歇性断网，应该不是P2P控制。请帮忙看看啊。

[已解决] 电脑网络间歇性断网

本帖子中包含更多资源