求助 - 網路會突然中斷卡死!

[mini]

作者: 愛撒謊的明

TO：mini

我已經使用您的教學，這樣就行了嗎@@?

感謝您的回答謝謝!

不知道～

要看發作時是否有效而不是個人能決定有效於否
如果沒用
那不是重灌OS比較快
就是
向中華電信報修
二選一

[愛撒謊的明]

我有兩台電腦，但是另外一台都不會這樣!

我想因該不是中華電信問題了@@"

[sob790717b]

個人覺得是XPSP2沒有進行更新的問題

[愛撒謊的明]

http://img360.imageshack.us/my.php?image=84275011.jpg
網路無法使用的時候會出現此回報視窗!

麻煩一下謝!

上網查了一下發現解決教學，但是我看不是很懂可否麻煩大大講白一點嗎0.0"
第 一:
就是病毒。開機后會提示Generic Host Process for Win32 Services 遇到問題需要

關閉”“Remote Rrocedure Call (RPC)服務意外終止，然後就自動重起電腦。一般該病毒會在註冊表HKEY_LOCAL_MACHINE\SOFTWAREMicrosoftWindowsCurrentVersionRun 下建立msblast.exe鍵值，還會在c:windowssystem32目錄下會放置一個msblast.exe的木馬程，解決方案如下︰

RPC漏洞

詳細描述:

最近發現部分RPC在使用TCP/IP協議處理訊息交換時不正確的處理畸形的消息導致存在一個安全漏洞。該漏洞影響使用RPC的DCOM界面，這個界面用來處理由客戶端機器發送給伺服器的DCOM對象激活請求(如UNC路徑)。如果攻擊者成功利用了該漏洞將獲得本地系統權限，他將可以在系統上營運任意命令，如安裝程式、查看或更改、刪除數據或者是建立系統管理員權限的帳戶等.

已發現的一個攻擊現象︰

攻擊者在用戶註冊表HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun 下建立一個叫“msupdate”(估計有變化)的鍵，鍵值一般為msblast.exeC:windowssystem32目錄下會放置一個msblast.exe的木馬程式.

另外受攻擊者會出現“Generic Host Process for Win32 Services 遇到問題需要關閉”“Remote Rrocedure Call (RPC)服務意外終止，Windows必須立即重新啟動”等錯誤訊息而重啟。

建議到http://www.microsoft.com/security/se...��打補丁。



第二
種情況是排除病毒后，還出現這樣的問題，一般都是IE組件在註冊表中註冊訊息被破壞，可以按下面的方法去解決該問題︰

1。 在"開始"菜單中打開"營運"窗口，在其中輸入"regsvr32 actxprxy.dll"，然後"確定"，接著會出現一個訊息對話 框"DllRegisterServer in actxprxy.dll succeeded"，再次點擊"確定"。

2 再次打開"營運"窗口，輸入"regsvr32 shdocvw.dll

3 再次打開"營運"窗口，輸入"regsvr32 oleaut32.dll

4 再次打開"營運"窗口，輸入"regsvr32 actxprxy.dll

5 再次打開"營運"窗口，輸入"regsvr32 mshtml.dll

6 再次打開"營運"窗口，輸入"regsvr32 msjava.dll

7 再次打開"營運"窗口，輸入"regsvr32 browseui.dll

8 再次打開"營運"窗口，輸入"regsvr32 urlmon.dll

如果排除病毒問題后，做完上面的幾個IE組件註冊一般問題即可得到解決

麻煩感謝!

[愛撒謊的明]

不好意思，現在網路似乎被我所安裝的 小紅傘防毒軟體處理好了!

已經可以上網不LAG不斷線了，不過卻又出現許多病毒..

如圖片：

麻煩一下謝謝ˊˋ此圖片一小部份，還有其他的病毒檔案沒照
例如J001.EXE、001.EXE..等的一些怪數字檔名的EXE，搞的快瘋了!

麻煩一下謝謝!

[danny_2]

《請參考》
http://forum.slime.com.tw/thread246138.html#post2138860

[愛撒謊的明]

不好意思，您叫我去看的那篇文章對我來說好深澳= ="看的有點母煞煞不好意思!

我PO報表麻煩幫檢查一下謝謝!

[code]

2009-05-11,20:44:04

System Repair Engineer 2.7.1.1261
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理許可權用戶 - 完整功能

以下內容被選中：
所有的啟動項目（包括註冊表、開機檔案夾、服務等）
流覽器載入項
正在運行的進程（包括進程模組資訊）
文件關聯
Winsock 提供者
Autorun.inf
HOSTS 文件
進程特權掃描
計畫任務
API HOOK
隱藏進程


啟動專案
註冊表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<foxy><"C:\Program Files\Foxy\Foxy.exe" -tray> [File is missing]
<KKBOX Tray Icon><C:\Program Files\KKBOX\KKBOX_Tray.exe> [Skysoft]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows Publisher]
<Messenger (Yahoo!)><"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet> [(Verified)Yahoo! Inc.]
<swg><C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe> [(Verified)Google Inc]
<BitComet><"C:\Program Files\BitComet\BitComet.exe" /tray> [(Verified)Comet Network Technology Co Ltd.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<avgnt><"C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min> [Avira GmbH]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [File is missing]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SSDPSRV]
<WinlogonNotify: SSDPSRV><C:\WINDOWS\System32\Systen.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
<自訂瀏覽器><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]

==================================
開機檔案夾
N/A

==================================
服務
[shapedaccdss Recpter / AdscdsessNum][Running/Auto Start]
<C:\WINDOWS\system32\Mosdfar.exe><N/A>
[Avira AntiVir Personal – Free Antivirus Scheduler / AntiVirScheduler][Running/Auto Start]
<"C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"><Avira GmbH>
[Avira AntiVir Personal – Free Antivirus Guard / AntiVirService][Running/Auto Start]
<"C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"><Avira GmbH>
[eScan Monitor Service / eScan Monitor Service][Stopped/Auto Start]
<C:\PROGRA~1\eScan\VISTA\avpmapp.exe><MicroWorld Technologies Inc.>
[eScan Server-Updater / eScan-trayicos][Running/Auto Start]
<C:\PROGRA~1\eScan\TRAYSSER.EXE><MicroWorld Technologies Inc.>
[fhgos soft Service / fhgos Service][Stopped/Auto Start]
<C:\WINDOWS\system32\SC3TP5MU2€\J001.exe><(File is missing)>
[Google Software Updater / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[ibzai / ibzai][Stopped/Auto Start]
<C:\WINDOWS\system32\ibzai.exe><(File is missing)>
[KingDuBa Driver A / KingDuuBa A][Running/Auto Start]
<C:\WINDOWS\system32\KiVIR.exe><N/A>
[MWAgent / MWAgent][Running/Auto Start]
<C:\Program Files\Common Files\MicroWorld\Agent\MWASER.EXE><MicroWorld Technologies Inc.>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Program Compatibility Assistan / PctaSvc][Stopped/Auto Start]
<C:\Program Files\R_Server\Slsvc.exe><(File is missing)>
[RDP Endpoint Mapper / RdpEptMapper][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k RdpService-->C:\WINDOWS\system32\rdpctrl.dll><N/A>
[Routing and Remote Access / RemoteAccess][Stopped/Disabled]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\mprdim.dll><Microsoft Corporation>
[QoS RSVP / RSVP][Stopped/Manual Start]
<C:\WINDOWS\system32\rsvp.exe><Microsoft Corporation>
[tapiessNumss Recoter / tapiessNum][Stopped/Auto Start]
<C:\WINDOWS\system32\wcssvbr.exe><(File is missing)>

==================================
驅動程式
[ADI DTS Filter Service / ADIDTSFiltService][Running/Manual Start]
<system32\drivers\adidts.sys><Analog Devices, Inc.>
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
<system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[ADMtek ADM8511/AN986 USB To Fast Ethernet Converter / ADM8511][Stopped/Manual Start]
<system32\DRIVERS\ADM8511.SYS><ADMtek Incorporated>
[AE Audio Service / AEAudio][Running/Manual Start]
<system32\drivers\AEAudio.sys><Andrea Electronics Corporation>
[avgio / avgio][Running/System Start]
<\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys><Avira GmbH>
[avgntflt / avgntflt][Running/Manual Start]
<\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys><Avira GmbH>
[avipbb / avipbb][Running/System Start]
<system32\DRIVERS\avipbb.sys><Avira GmbH>
[city / city][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\city.ahc><N/A>
[eScan Monitor Extension / ESCANMX][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\escanmxx.sys><MicroWorld Technologies Inc. - www.mwti.net>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Kaspersky Lab Driver / KLIF][Running/System Start]
<system32\DRIVERS\klif.sys><Kaspersky Lab>
[ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
<system32\DRIVERS\ASACPI.sys><>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Process Creation Monitor / ProcObsrves][Stopped/Manual Start]
<\??\C:\PROGRA~1\eScan\ProcObsrves.sys><N/A>
[直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Running/Auto Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[StarForce Protection Environment Driver (version 1.x) / sfdrv01][Running/Boot Start]
<\SystemRoot\System32\drivers\sfdrv01.sys><Protection Technology>
[StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
<\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology>
[StarForce Protection Synchronization Driver (version 2.x) / sfsync02][Running/Boot Start]
<\SystemRoot\System32\drivers\sfsync02.sys><Protection Technology>
[sptd / sptd][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[系統還原篩選器驅動程式 / sr][Running/Boot Start]
<\SystemRoot\\SystemRoot\system32\DRIVERS\sr.sys><N/A>
[ssmdrv / ssmdrv][Running/System Start]
<system32\DRIVERS\ssmdrv.sys><Avira GmbH>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[npkcrypt / npkcrypt][Running/Manual Start]
<\??\C:\Program Files\Gamania\天堂(Lineage 2.70C)\npkcrypt.sys><INCA Internet Co., Ltd.>

==================================