请高手先看看我的扫描报告（由于字数限制，分批贴出）

扫描时间

2007-5-17 8:13:26 - 2007-5-17 8:22:41



检测结果

- 存活主机 : 1
- 漏洞数量 : 8
- 警告数量 : 5
- 提示数量 : 20



主机列表

127.0.0.1 (发现安全漏洞)
. OS: Microsoft Windows XP; PORT/TCP: 135, 445, 1025, 5000



详细资料

+ 127.0.0.1 :
. 开放端口列表 :
  o microsoft-ds (445/tcp) (发现安全漏洞)
  o www (1025/tcp) (发现安全提示)
  o epmap (135/tcp) (发现安全漏洞)
  o netbios-ssn (139/tcp) (发现安全警告)
  o Windows XP UPNP (5000/tcp) (发现安全警告)
  o DCE/1ff70682-0a51-30e8-076d-740be8cee98b (1026/tcp) (发现安全提示)
  o DCE/378e52b0-c0a9-11cf-822d-00aa0051e40f (1026/tcp) (发现安全提示)
  o DCE/0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 (1026/tcp) (发现安全提示)
  o tcp (发现安全漏洞)
  o ntp (123/udp) (发现安全提示)
  o unknown (1720/tcp) (发现安全提示)

. 端口"microsoft-ds (445/tcp)"发现安全漏洞 :


   
    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 12054

. 端口"microsoft-ds (445/tcp)"发现安全漏洞 :


    运行某版本Microsoft操作系统的远程主机可能会存在几种形式的漏洞：包括拒绝服务，远程执行任意代码等。Microsoft已经发布了修订补丁(KB835732)来解决这些问题。
___________________________________________________________________


The remote version of Windows contains a flaw in the Server Message
Block (SMB) implementation which may allow an attacker to execute arbitrary
code on the remote host.

Solution : http://www.microsoft.com/technet/security/bulletin/ms05-027.mspx
Risk factor : High
CVE_ID : CAN-2005-1208
BUGTRAQ_ID : 13942
NESSUS_ID : 12209



. 端口"microsoft-ds (445/tcp)"发现安全漏洞 :


   
    The remote version of Windows contains a flaw in the Server Message
    Block (SMB) implementation which may allow an attacker to execute arbitrary
    code on the remote host.
   
    Solution : http://www.microsoft.com/technet/security/bulletin/ms05-027.mspx
    Risk factor : High
    CVE_ID : CAN-2005-1208
    BUGTRAQ_ID : 13942
    NESSUS_ID : 18502

. 端口"microsoft-ds (445/tcp)"发现安全漏洞 :


    运行某版本Microsoft操作系统的远程主机可能会存在几种形式的漏洞：包括拒绝服务，远程执行任意代码等。Microsoft已经发布了修订补丁(KB835732)来解决这些问题。
___________________________________________________________________


The remote host seems to be running a version of Microsoft OS
which is vulnerable to several flaws, ranging from  denial of service
to remote code execution.  Microsoft has released a Hotfix (KB835732)
which addresses these issues.

Solution : Install the Windows cumulative update from Microsoft

See also : http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

Risk factor : High
NESSUS_ID : 12209
Other references : IAVA:2004-A-0006



. 端口"microsoft-ds (445/tcp)"发现安全漏洞 :


   
    The remote version of Windows contains a flaw in the Server Message
    Block (SMB) implementation which may allow an attacker to execute arbitrary
    code on the remote host.
   
    Solution : http://www.microsoft.com/technet/security/bulletin/ms05-027.mspx
    Risk factor : High
    CVE_ID : CAN-2005-1208
    BUGTRAQ_ID : 13942
    NESSUS_ID : 18502

. 端口"microsoft-ds (445/tcp)"发现安全警告 :


    该版本的Windows存在一个漏洞，可能令攻击者有机会
    利用它的命名管道导致信息泄漏
    该命名管道是通过空会话产生的.
   
    攻击者可以探测到该漏洞并获得
    更多该远程主机的信息.
   
    解决方案 : http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx
    风险等级: 低
    ___________________________________________________________________
   
   
    The remote version of Windows contains a flaw which may allow an attacker
    to cause it to disclose information over the use of a named pipe through
    a NULL session.
   
    An attacker may exploit this flaw to gain more knowledge about the
    remote host.
   
    Solution : http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx
    Risk factor : Low
    CVE_ID : CAN-2005-0051
    BUGTRAQ_ID : 12486
    NESSUS_ID : 16337

. 端口"microsoft-ds (445/tcp)"发现安全警告 :


    该版本的Windows存在一个漏洞，可能令攻击者有机会
    利用它的命名管道导致信息泄漏
    该命名管道是通过空会话产生的.
   
    攻击者可以探测到该漏洞并获得
    更多该远程主机的信息.
   
    解决方案 : http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx
    风险等级: 低
    ___________________________________________________________________
   
   
    The remote version of Windows contains a flaw which may allow an attacker
    to cause it to disclose information over the use of a named pipe through
    a NULL session.
   
    An attacker may exploit this flaw to gain more knowledge about the
    remote host.
   
    Solution : http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx
    Risk factor : Low
    CVE_ID : CAN-2005-0051
    BUGTRAQ_ID : 12486
    NESSUS_ID : 16337

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    "microsoft-ds"服务可能运行于该端口.
   
    NESSUS_ID : 10330

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    远程主机开放了445端口，没有开放139端口。
   
    两台Windows 2000
    主机间的'Netbios-less'通讯通过445端口完成。攻击者可以利用该漏洞获取主机的共享连接，用户名列表及其他信息...

解决方案: 过滤该端口收到的数据。
风险等级: 中
___________________________________________________________________

A CIFS server is running on this port
NESSUS_ID : 11011



. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    当前脚本尝试使用多个login/password组合登陆远程主机
   
    参考资料: http://support.microsoft.com/support/kb/articles/Q143/4/74.ASP
    参考资料: http://support.microsoft.com/support/kb/articles/Q246/2/61.ASP
   
    风险等级: 中
    ___________________________________________________________________
   
    - NULL sessions are enabled on the remote host
   
    CVE_ID : CAN-1999-0504, CAN-1999-0506, CVE-2000-0222, CAN-1999-0505,
    CAN-2002-1117
    BUGTRAQ_ID : 494, 990, 11199
    NESSUS_ID : 10394

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    当前脚本尝试使用多个login/password组合登陆远程主机
   
    参考资料: http://support.microsoft.com/support/kb/articles/Q143/4/74.ASP
    参考资料: http://support.microsoft.com/support/kb/articles/Q246/2/61.ASP
   
    风险等级: 中
    ___________________________________________________________________
   
    - NULL sessions are enabled on the remote host
   
    CVE_ID : CAN-1999-0504, CAN-1999-0506, CVE-2000-0222, CAN-1999-0505,
    CAN-2002-1117
    BUGTRAQ_ID : 494, 990, 11199
    NESSUS_ID : 10394

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    用户可以使用SMB测试中的login / password 组合远程连接注册表。
    允许远程连接注册表存在潜在危险，攻击者可能由此获取更多主机信息。
   
    解决方案: 如果还没有安装service pack 3补丁，先安装之。同时设置注册表子键
    HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg
    的权限，只允许管理员用户浏览其内容。
   
    另外，有必要考虑从相关端口过滤主机接收到的数据。
   
    风险等级: 低
    ___________________________________________________________________
   
    It was not possible to connect to PIPE\winreg on the remote host.
    If you intend to use Nessus to perform registry-based checks, the registry
    checks will not work because the 'Remote Registry Access' service (winreg)
    has been disabled on the remote host or can not be connected to with the
    supplied credentials.
    NESSUS_ID : 10400

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    用户可以使用SMB测试中的login / password 组合远程连接注册表。
    允许远程连接注册表存在潜在危险，攻击者可能由此获取更多主机信息。
   
    解决方案: 如果还没有安装service pack 3补丁，先安装之。同时设置注册表子键
    HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg
    的权限，只允许管理员用户浏览其内容。
   
    另外，有必要考虑从相关端口过滤主机接收到的数据。
   
    风险等级: 低
    ___________________________________________________________________
   
    It was not possible to connect to PIPE\winreg on the remote host.
    If you intend to use Nessus to perform registry-based checks, the registry
    checks will not work because the 'Remote Registry Access' service (winreg)
    has been disabled on the remote host or can not be connected to with the
    supplied credentials.
    NESSUS_ID : 10400

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    当前插件尝试探测远程native lan manager 名(Samba, Windows...)。
   
    风险等级: 低
    ___________________________________________________________________
   
    The remote native lan manager is : Windows 2000 LAN Manager
    The remote Operating System is : Windows 5.1
    The remote SMB Domain Name is : WORKGROUP
   
    NESSUS_ID : 10785

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    当前插件尝试探测远程native lan manager 名(Samba, Windows...)。
   
    风险等级: 低
    ___________________________________________________________________
   
    The remote native lan manager is : Windows 2000 LAN Manager
    The remote Operating System is : Windows 5.1
    The remote SMB Domain Name is : WORKGROUP
   
    NESSUS_ID : 10785

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    当前脚本通过\PIPE\LANMAN交易管道获取远程主机浏览列表。
   
    风险等级: 低
    ___________________________________________________________________
   
    Here is the browse list of the remote host :
   
    BILLGATES ( os: 5.1 )
   
   
    This is potentially dangerous as this may help the attack
    of a potential hacker by giving him extra targets to check for
   
    Solution : filter incoming traffic to this port
    Risk factor : Low
   
    NESSUS_ID : 10397

. 端口"microsoft-ds (445/tcp)"发现安全提示 :


    当前脚本通过\PIPE\LANMAN交易管道获取远程主机浏览列表。
   
    风险等级: 低

Here is the browse list of the remote host :
   
    BILLGATES ( os: 5.1 )
   
   
    This is potentially dangerous as this may help the attack
    of a potential hacker by giving him extra targets to check for
   
    Solution : filter incoming traffic to this port
    Risk factor : Low
   
    NESSUS_ID : 10397

. 端口"www (1025/tcp)"发现安全提示 :


    "WEB"服务运行于该端口
    BANNER信息 :
   
    HTTP/1.0 403 Forbidden
    Content-Length: 0
    Connection: close
   
   
    NESSUS_ID : 10330

. 端口"epmap (135/tcp)"发现安全漏洞 :


    远程Windows主机的RPC接口存在缓冲区溢出漏洞。
    该漏洞可导致远程攻击者以SYSTEM权限在系统中执行任意代码。
   
    远程攻击者或蠕虫能据此获得主机的控制权。
   
    注意:此BUG不同于NMS03-026，NMS03-026漏洞造成了'MSBlast'
    (又名LoveSan)蠕虫泛滥
   
    解决方案:参考
    http://www.microsoft.com/technet/security/bulletin/MS03-039.asp
   
    风险等级 : 高
    ___________________________________________________________________
   
   
    The remote host is running a version of Windows which has a flaw in
    its RPC interface, which may allow an attacker to execute arbitrary code
    and gain SYSTEM privileges.
   
    An attacker or a worm could use it to gain the control of this host.
   
    Note that this is NOT the same bug as the one described in MS03-026
    which fixes the flaw exploited by the 'MSBlast' (or LoveSan) worm.
   
    Solution: see
    http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx
    Risk factor : High
    CVE_ID : CAN-2003-0715, CAN-2003-0528, CAN-2003-0605
    BUGTRAQ_ID : 8458, 8460
    NESSUS_ID : 11835
    Other references : IAVA:2003-A-0012

. 端口"epmap (135/tcp)"发现安全漏洞 :


    远程Windows主机的RPC接口存在缓冲区溢出漏洞。
    该漏洞可导致远程攻击者以SYSTEM权限在系统中执行任意代码。
   
    远程攻击者或蠕虫能据此获得主机的控制权。
   
    该漏洞已经引发了至少一个蠕虫：MSBlast。
   
    解决方案:参考
    http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
   
    风险等级 : 严重
    ___________________________________________________________________
   
   
    The remote host is running a version of Windows which has a flaw in
    its RPC interface which may allow an attacker to execute arbitrary code
    and gain SYSTEM privileges.  There is at least one Worm which is
    currently exploiting this vulnerability.  Namely, the MsBlaster worm.
   
    Solution: see
    http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx
    Risk factor : High
    CVE_ID : CAN-2003-0352
    BUGTRAQ_ID : 8205
    NESSUS_ID : 11808
    Other references : IAVA:2003-A-0011

. 端口"epmap (135/tcp)"发现安全提示 :


    "epmap"服务可能运行于该端口.
   
    NESSUS_ID : 10330

. 端口"epmap (135/tcp)"发现安全提示 :


   
    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 10736

. 端口"epmap (135/tcp)"发现安全提示 :


   
    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 10736

. 端口"epmap (135/tcp)"发现安全提示 :


   
    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 10736

. 端口"netbios-ssn (139/tcp)"发现安全警告 :


    [远程注册表信息]:
   
    [ProductName]: Microsoft Windows XP
    [SOFTWARE\Microsoft\Windows NT\CurrentVersion]:
    CurrentBuild: 1.511.1 () (Obsolete data - do not use)
    InstallDate: 76 DA E3 45
    ProductName: Microsoft Windows XP
    RegDone: 
    RegisteredOrganization: Microsoft
    RegisteredOwner: Billgates
    SoftwareType: SYSTEM
    CurrentVersion: 5.1
    CurrentBuildNumber: 2600
    BuildLab: 2600.xpsp1.020828-1920
    CurrentType: Uniprocessor Free
    CSDVersion: Service Pack 1
    SystemRoot: C:\WINDOWS
    SourcePath: E:\I386
    PathName: C:\WINDOWS
    ProductId: 55661-005-0809362-22218
    DigitalProductId: A4 00 00 00 03 00 00 00 35 35 36 36 31 2D 30 30 35 2D 30
    38 30 39 33 36 32 2D 32 32 32 31 38 00 2C 00 00 00 41 32 32 2D 30 30 30 30
    31 00 00 00 00 00 00 00 D0 0E 9B 80 75 31 D5 CA 12 55 6B 1F B6 44 00 00 00
    00 00 00 B4 47 E4 45 F7 8A 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 31 38 34 32 34 00 00 00 00 00 00 00 23 0E 00
    00 07 16 56 28 00 01 00 00 99 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F9 3A 03 70
    LicenseInfo: B5 AD 3D 30 DC CD 2A 79 FD C0 5B 71 56 99 3A 2D E5 15 DD 39 49
    28 D5 37 2F 5D 58 8B 8B 3E 73 E0 9D 02 86 E4 FE 02 00 55 A7 1B 0C 15 6F BE
    AE 07 FC 36 76 D9 C0 31 BA EC
   
   
    [SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]:
    AutoRestartShell: 01 00 00 00
    DefaultDomainName: BILLGATES
    DefaultUserName: Steven
    LegalNoticeCaption: 
    LegalNoticeText: 
    PowerdownAfterShutdown: 1
    ReportBootOk: 1
    Shell: EXPLORER.EXE
    ShutdownWithoutLogon: 0
    System: 
    Userinit: userinit.exe,
    VmApplet: rundll32 shell32,Control_RunDLL "sysdm.cpl"
    SfcQuota: FF FF FF FF
    PreloadFontFile: simsun
    allocatecdroms: 0
    allocatedasd: 0
    allocatefloppies: 0
    cachedlogonscount: 10
    forceunlocklogon: 00 00 00 00
    passwordexpirywarning: 0E 00 00 00
    scremoveoption: 0
    AllowMultipleTSSessions: 01 00 00 00
    UIHost: 6C 6F 67 6F 6E 75 69 2E 65 78 65 00
    LogonType: 01 00 00 00
    Background: 0 0 0
    AutoAdminLogon: 0
    DebugServerCommand: no
    SFCDisable: 00 00 00 00
    WinStationsDisabled: 0
    HibernationPreviouslyEnabled: 01 00 00 00
    ShowLogonOptions: 01 00 00 00
    AltDefaultUserName: Steven
    AltDefaultDomainName: BILLGATES
   
   
    [SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix]:
    [SOFTWARE\Microsoft\Windows NT\CurrentVersion\HotFix\Q147222]:
    Installed: 01 00 00 00
   
   

. 端口"netbios-ssn (139/tcp)"发现安全警告 :


    [服务器时间]:
   
    05-17-2007  00:14:7 GMT
   

. 端口"Windows XP UPNP (5000/tcp)"发现安全警告 :


    远程主机正在运行Microsoft UPnP TCP helper服务.
   
    如果被测试的网络不是一个家庭网络，那么你应该禁用这项服务
   
    解决方案:如下更改注册表键值
    位置：HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRV
    键名：Start
    键值：0x04
   
   
    风险等级 : 低

The remote host is running Microsoft UPnP TCP helper.
   
    If the tested network is not a home network, you should disable
    this service.
   
    Solution : Set the following registry key :
                    Location : HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRV
                    Key      : Start
                    Value    : 0x04
   
   
    Risk factor : Low
    CVE_ID : CVE-2001-0876
    BUGTRAQ_ID : 3723
    NESSUS_ID : 11765

. 端口"DCE/1ff70682-0a51-30e8-076d-740be8cee98b (1026/tcp)"发现安全提示 :


    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
   
    Here is the list of DCE services running on this port:
   
        UUID: 1ff70682-0a51-30e8-076d-740be8cee98b, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
        Named pipe : atsvc
        Win32 service or process : mstask.exe
        Description : Scheduler service
   
        UUID: 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
   
        UUID: 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
   
   
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 10736

. 端口"DCE/378e52b0-c0a9-11cf-822d-00aa0051e40f (1026/tcp)"发现安全提示 :


    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
   
    Here is the list of DCE services running on this port:
   
        UUID: 1ff70682-0a51-30e8-076d-740be8cee98b, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
        Named pipe : atsvc
        Win32 service or process : mstask.exe
        Description : Scheduler service
   
        UUID: 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
   
        UUID: 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
   
   
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 10736

. 端口"DCE/0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 (1026/tcp)"发现安全提示 :


    Distributed Computing Environment (DCE) services running on the remote host
    can be enumerated by connecting on port 135 and doing the appropriate
    queries.
   
    An attacker may use this fact to gain more knowledge
    about the remote host.
   
   
    Here is the list of DCE services running on this port:
   
        UUID: 1ff70682-0a51-30e8-076d-740be8cee98b, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
        Named pipe : atsvc
        Win32 service or process : mstask.exe
        Description : Scheduler service
   
        UUID: 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
   
        UUID: 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53, version 1
        Endpoint: ncacn_ip_tcp:127.0.0.1[1026]
   
   
   
    Solution : filter incoming traffic to this port.
    Risk factor : Low
    NESSUS_ID : 10736

. 端口"tcp"发现安全漏洞 :


    计划任务应用程序存在一个缺陷，它允许远程攻击者能够远程执行代码。
    有许多攻击工具利用了这个缺陷。
    一个利用此漏洞的攻击者将有能力连接到目标主机或者能够强迫本地用户安装.job文件或浏览一个恶意的web站点。

参考:http://www.microsoft.com/technet/security/bulletin/ms04-022.mspx

风险等级:高
___________________________________________________________________


There is a flaw in the Task Scheduler application which could allow a
remote attacker to execute code remotely.  There are many attack vectors
for this flaw.  An attacker, exploiting this flaw, would need to either
have the ability to connect to the target machine or be able to coerce a
local user to either install a .job file or browse to a malicious website.

See also : http://www.microsoft.com/technet/security/bulletin/ms04-022.mspx

Risk factor : High
CVE_ID : CAN-2004-0212
BUGTRAQ_ID : 10708
NESSUS_ID : 13852



. 端口"ntp (123/udp)"发现安全提示 :


   
    A NTP (Network Time Protocol) server is listening on this port.
   
    Risk factor : Low
    NESSUS_ID : 10884

. 端口"unknown (1720/tcp)"发现安全提示 :


    H323是互联网上广泛流行的一种协议。它被用于Voice Over IP (VoIP),
   
    ___________________________________________________________________
   
   
    H323 is a protocol used all over the Internet.  It is used for
    Voice Over IP (VoIP), Microsoft NetMeeting, and countless other
    applications.  Nessus was able to determine that the remote device
    supports the H323 protocol.  It is in your best interest to run a
    separate audit against this IP to determine the potential risk
    introduced by this application. 
   
    Risk factor : None
    NESSUS_ID : 12243




------------------------------------------------------
本报表由网络安全漏洞扫描器"X-Scan"生成.
在这之前我已经手工在本地安全策略里关闭了455，135等端口，为什么还会出现以上情况呢？而且我在赛门铁克安全论坛上进行漏洞扫描，这些端口却是隐藏的，两次扫描的结果竟然不同，但是电脑中毒是真，系统时间被修改，系统文件被修改，而且瑞星最新的版本无法查出来。请高手帮帮我。