A problem of attack detection and state estimation in continuous time distributed observer system under combination attack which is defined as in the presence of measurement attack and observer communication attack is considered in this paper. We adopt the notion of virtual state to design an algorithm for attack detection. The algorithm is distributedly used in each local observer and does not need nonlocal information, thus it can be run by only itself. Additionally, we derive the inequality relationship between system graph connectivity and the number of the allowable attacked observer to achieve the detection and estimation with the proposed algorithm as a necessary and sufficient condition. A simple numerical example, finally, illustrates the effectiveness of the proposed algorithm.