攻防大全(国外英语资料).docVIP

攻防大全(国外英语资料) I briefly introduce the manual solution to the problem of ARP virus, and we hope to be helpful. General processing steps for solving ARP viruses: 1.1) remove the virus component releaser %windows%/SYSTEM32/ (*).Exe (*) stands for the name of the main program file of the virus, the file that has appeared is called loadhw.exe, and of course it may be another name. 2) remove the driver for the ARP spoofing package (and virus daemon) %windows%/System32/drivers/npf.sys A. device manager, click View show hidden devices; B. opens non plug and play in the device tree structure... ; C. found NetGroup Packet Filter Driver. If you do not find it, please refresh the device list first; D. right-click on the NetGroup Packet Filter Driver menu and select uninstall; E. restart windows system,; F. deletes%windows%/System32/drivers/npf.sys. 3) remove the command driver and send ARP spoofing packets to the controller %windows%/System32/msitinit.dll 2. remove the registry service of the following virus dummy driver: HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Npf Prevention of ARP attacks: Dont base your network security trust relationship on IP or Mac. (RARP also has the problem of cheating), the ideal relationship should be based on ip+mac. Set the static mac--ip table, and do not let the host refresh the converted table that you have set. The administrator periodically gets a RARP request in the response IP package, and then checks the authenticity of the ARP response. Check the ARP cache on the host and use the firewall to monitor the network continuously. (note that if SNMP is used, ARP spoofing can lead to trap packet loss) ARP attack and Protection Manual 1. ARP concept Before we talk about ARP, we must first know the concept and working principle of ARP, understand the principles of knowledge, in order to better face and analyze the problem. 1.1. ARP conceptual knowledge ARP, the full name Address Resolution Protocol, is called address resolution protocol