Spoofer.ARP.Inject.01

Overview

Vendor Description

From the doc: "RMost operating systems will update their ARP cache when will receive this kind of packets.PYou could send an ARP reply to a target host with IP address of the gateway andPbogus MAC address.This way , the target host will be isolated from the networkDisclaimer:MThis is a proof of concept tool and the author is not liable for any damagesNcaused by direct or indirect use of the information or functionality providedby this program.This tool requires WinPcap , available at :http://netgroup-serv.polito."

Alias

Univ.EG [Panda],

Category

Spoofer: To spoof is to forge your identity. Attackers use spoofers to forge their IP address (IP spoofing). The most common use of spoofing today is smurf and fraggle attacks. These attacks use spoofed packets against amplifiers in order to overload the victim's connection. This is done by sending a single packet to a broadcast address with the victim as the source address. All the machines within the broadcast domain then respond back to the victim, overloading the victim's Internet connection. Since smurfing accounts for more than half the traffic on some backbones, ISPs are starting to take spoofing seriously and have started implementing measures within their routers that verify valid source addresses before passing the packets.

Origins

URL

http://www.netgroup-serv.polito

Programming Language

Delphi

Date of Origin

April, 2001

Detection and Removal

Manual Removal

Follow these steps to remove Spoofer.ARP.Inject.01 from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:

Remove Files:

Remove these files (if present) with Windows Explorer:

Spewfy1.96 SpheReFakeMailer2 SpinAudioRoomVerbcracker SpiritMail Spoof Spoofer.ARP.Inject.01 Spoofer.ARP.Netxys Spoofer.Win32.Joel Spoofer.Win32.VB.c SpotOnBrowserplugin