老提示arp欺骗 怎么消除？如果是病毒怎么查杀呢，我是单位局域网，已经绑定了mac地址好了一阵子还是老提示。今天日志已经显示2000多项了


用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)

找到发包原的机子  杀毒~~~

断网杀才会干净

http://hi.baidu.com/xznhygsd/blog/item/95069e8f0e6712f9513d92f0.html

参考这个:

一般是把提示的消息去掉。

另外，重要设置的是防御指定的计算机——网关
其它的不防，并且检查IP地址与MAC地址是否绑定正确？（增加网关IP地址后点自动获取）

怎么样才能找到哪台发包的机器呢？

可以查看下帖
http://bbs.ikaka.com/showtopic-8430850.aspx

看过windows的防火墙日志了，看不懂
帮忙解释下，多谢 ~~0.119是我的

#Version: 1.5
#Software: Microsoft Windows Firewall
#Time Format: Local
#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path
2009-02-24 09:06:54 CLOSE TCP 192.168.0.119 219.238.235.105 1135 80 - - - - - - - - -
2009-02-24 09:07:30 CLOSE TCP 192.168.0.119 219.238.235.100 1142 80 - - - - - - - - -
2009-02-24 09:07:55 CLOSE TCP 192.168.0.119 219.238.235.105 1172 80 - - - - - - - - -
2009-02-24 09:08:00 CLOSE TCP 192.168.0.119 219.238.235.105 1139 80 - - - - - - - - -
2009-02-24 09:08:31 OPEN TCP 192.168.0.119 211.103.159.78 1284 80 - - - - - - - - -
2009-02-24 09:08:31 OPEN TCP 192.168.0.119 211.103.159.78 1286 80 - - - - - - - - -
2009-02-24 09:08:31 OPEN UDP 192.168.0.119 61.177.7.1 50832 53 - - - - - - - - -
2009-02-24 09:19:14 OPEN UDP 192.168.0.119 192.168.0.123 137 137 - - - - - - - - -
2009-02-24 09:19:57 CLOSE TCP 192.168.0.119 211.103.159.78 1565 80 - - - - - - - - -
2009-02-24 09:20:19 OPEN TCP 192.168.0.119 209.85.143.127 1680 80 - - - - - - - - -
2009-02-24 09:20:20 OPEN TCP 192.168.0.119 58.218.205.126 1686 80 - - - - - - - - -
2009-02-24 09:20:22 OPEN TCP 192.168.0.119 209.85.143.127 1689 80 - - - - - - - - -
2009-02-24 09:20:25 OPEN TCP 192.168.0.119 219.238.235.105 1692 80 - - - - - - - - -
2009-02-24 09:20:25 OPEN TCP 192.168.0.119 219.238.235.105 1694 80 - - - - - - - - -
2009-02-24 09:20:25 OPEN TCP 192.168.0.119 219.238.235.105 1696 80 - - - - - - - - -
2009-02-24 09:20:19 OPEN UDP 192.168.0.119 192.168.0.1 54450 53 - - - - - - - - -
2009-02-24 09:20:19 OPEN TCP 192.168.0.119 219.238.235.105 1676 80 - - - - - - - - -
2009-02-24 09:20:19 OPEN TCP 192.168.0.119 219.238.235.105 1677 80 - - - - - - - - -
2009-02-24 09:20:19 CLOSE TCP 192.168.0.119 219.238.235.105 1677 80 - - - - - - - - -
2009-02-24 09:20:19 OPEN TCP 192.168.0.119 219.238.235.105 1682 80 - - - - - - - - -
2009-02-24 09:20:20 OPEN TCP 192.168.0.119 219.238.235.100 1684 80 - - - - - - - - -
2009-02-24 09:20:24 CLOSE UDP 192.168.0.119 192.168.0.123 137 137 - - - - - - - - -
2009-02-24 09:20:25 CLOSE TCP 192.168.0.119 219.238.235.105 1676 80 - - - - - - - - -
2009-02-24 09:20:25 DROP TCP 219.238.235.105 192.168.0.119 80 1676 40 A 3321429332 2412706233 64265 - - - RECEIVE
2009-02-24 09:20:25 DROP TCP 219.238.235.105 192.168.0.119 80 1676 40 FA 3321429332 2412706233 64265 - - - RECEIVE
2009-02-24 09:20:25 CLOSE TCP 192.168.0.119 219.238.235.105 1682 80 - - - - - - - - -
2009-02-24 09:20:25 CLOSE TCP 192.168.0.119 219.238.235.105 1692 80 - - - - - - - - -
2009-02-24 09:20:25 DROP TCP 219.238.235.105 192.168.0.119 80 1692 40 A 898844554 2778603526 64259 - - - RECEIVE
2009-02-24 09:20:25 DROP TCP 219.238.235.105 192.168.0.119 80 1692 40 FA 898844554 2778603526 64259 - - - RECEIVE
2009-02-24 09:20:25 DROP TCP 219.238.235.105 192.168.0.119 80 1682 40 A 3485938731 2869527335 65535 - - - RECEIVE
2009-02-24 09:20:25 DROP TCP 219.238.235.105 192.168.0.119 80 1682 40 FA 3485938731 2869527335 65535 - - - RECEIVE
2009-02-24 09:20:26 OPEN TCP 192.168.0.119 220.165.9.63 1699 80 - - - - - - - - -
2009-02-24 09:20:26 CLOSE TCP 192.168.0.119 220.165.9.63 1699 80 - - - - - - - - -
2009-02-24 09:20:32 OPEN TCP 192.168.0.119 219.238.235.105 1704 80 - - - - - - - - -
2009-02-24 09:20:32 OPEN TCP 192.168.0.119 219.238.235.105 1706 80 - - - - - - - - -
2009-02-24 09:20:33 OPEN TCP 192.168.0.119 219.238.235.105 1710 80 - - - - - - - - -
2009-02-24 09:20:32 CLOSE TCP 192.168.0.119 219.238.235.105 1696 80 - - - - - - - - -
2009-02-24 09:20:32 DROP TCP 219.238.235.105 192.168.0.119 80 1696 40 A 1964145345 3939625297 65535 - - - RECEIVE
2009-02-24 09:20:32 DROP TCP 219.238.235.105 192.168.0.119 80 1696 40 FA 1964145345 3939625297 65535 - - - RECEIVE

瑞星提示的信息是欺诈包 ip
是网关地址 mac 是 00-17-9a-68-9d-91

请教一个问题 arp -a 后有的机器就出现网关一个ip 为什么有的机器出现很多个ip 地址呢 ？ 而且有的机器出现的网关ip对应的mac地址就是那个攻击我的机器的地址错误的那个？

APP缓存中网关IP对应的MAC地址如果不是真实的网关MAC地址，则为ARP攻击源的MAC地址；
一个MAC地址对应多个IP地址的为ARP攻击源的MAC地址；
在网关ARP缓存中一个MAC对应多个IP的为ARP攻击源的MAC地址。