通过在本地机子上安装相同版本的ARP防火墙,并对其进行监视,发现主窗口隐藏/恢复热键保存在其安装目录下的aas.ini文件中,该文件内容如下:
[AAS]
BlockSendArpSpoof=1
BlockSendIpSpoof=1
AttackAlert=1
SafeMode=1
HotkeyHide=16473
HotkeyMin=0
AutoProtect=1
AutoMin=1
RunAtUserLogon=1
RunAsService=0
AutoHide=0
HideTabSheetWithNoData=1
IpSortFormat=0
ManualSetGatewayIpMac=0
GatewayIp=
GatewayMac=
AutoSaveLog=0
AutoSaveLogPath=
LogSaveInterval=30
CRC2=
PwdUninstall=0
PwdShowFromHide=0
PwdConfig=0
PwdExit=0
PwdStopProtect=0
PwdInheritConfig=1
DefendStop=0
DefendWatch=1
DefendRun=0
DefendSpeed=8
ScanManual=0
ScanSmart=1
ScanAuto=0
DetectMacScan=1
DetectSwitchAttack=1
DetectMgtSoft=1
ProtectArpCache=1
HookSystemTime=1
ProtectProcess=1
ProtectProcessShowAlert=0
ProtectIeStartPage=1
ControlSendArp=0
SendArpSpeed=40
SendArpBlock=30
ControlSendUdp=0
SendUdpSpeed=500
SendUdpBlock=30
ControlSendIcmp=0
SendIcmpSpeed=100
SendIcmpBlock=30
ControlSendTcpSyn=0
SendTcpSynSpeed=100
SendTcpSynBlock=30
AllowExcept=0
AllowList=
AlertFlashIcon=1
AlertBalloon=1
AlertPlayWav=0
AlertPlayWavName=
AlertRunExe=0
AlertRunExeName=
AlertOpenUrl=0
AlertOpenUrlName=
AlertSendMail=0
AlertPrimarySmtp=0
AlertPrimarySmtpAuth=0
AlertPrimarySmtpIp=
AlertPrimarySmtpPort=0
AlertPrimarySmtpUser=
AlertPrimarySmtpPass=
AlertBackupSmtp=0
AlertBackupSmtpAuth=0
AlertBackupSmtpIp=
AlertBackupSmtpPort=0
AlertBackupSmtpUser=
AlertBackupSmtpPass=
AlertSmtpFrom=
AlertSmtpTo=
AlertSmtpSubject=
RouterLogUntrust=1
RouterBlockUntrust=0
TrustRouter=
ManagePrimaryIp=
ManagePrimaryPort=0
ManageBackupIp=
ManageBackupPort=0
ClientUpdateInterval=1
ClientUpdateIntervalRealTime=1
OA=15
AutoResetCount=0
IntervalResetCount=24
AllowClientUpdate=0
DetectNetBroke=0
蓝色一行即为热键值,那怎么查出对应的热键呢?通过《Windows所有可选快捷键及其键值列表》即可查得16473对应的热键为Ctrl+Y,服务器上该值为16474,即为Ctrl+Z,然而在服务器上按Ctrl+Z,主窗口并未显示出来😢
比对了下本地和服务器的ARP防火墙,发现本地是以当前登录用户运行的,而服务器上的却是以SYSTEM身份运行的,猜测正是这个原因导致服务器上主窗口显示不出来吧,用找回热键来显示主窗口的思路失败了。
那只能重新启动程序来打开主窗口了,进程不能结束,只好重启服务器了,最终通过下边步骤打开了防火墙主窗口:
①.在"控制面板→管理工具→服务"中找到"ARP防火墙加载程序",禁用它;
②.运行msconfig,在"启动"选项卡中看有没有AntiARP,有就去掉前面的钩;
③.打开aas.ini,找到AutoHide设置为0,保存,这样程序启动后不会自动隐藏主窗口;
④.重启服务器,待系统启动后手工运行ARP防火墙就可以了;
评论(0)
暂无评论。