ARP cache poisoning attack

DextrousDave · 16 May 2012

Hi All

ESET Nod32 is picking up an ARP cache poisoning attack as well as a Port scanning attack(daily) from one of the other Windows PC's on my home LAN. The other PC, like mine is a Windows 7 PC, both Home Premium.

Is that possibly malware or a virus on the other PC that is doing this? Does this affect my internet speeds, cause I've been really getting slow internet speeds since these message started appearing first.

Any suggestion on how I should handle this?

Thanks

UsernameIssues · 16 May 2012

DextrousDave said:

Hi All
~~~
Any suggestion on how I should handle this?

Thanks

You could stick to one thread ;-)

Try running ESET's online scanner on the other computer.

Edit: Below is what you might see the first time you use that online scanner on IE8 or IE9. Subsequent scans are quicker. If desired, the online scanning tool can be uninstalled via the web interface after the scan completes or via the normal OS interface for uninstalling apps.

ESET's online scanner seems to get along with most other anti-virus tools.

(You may need to view in the full screen mode and at 480p)

Jacee · 16 May 2012

You might want to try ARPCache Viewer (freeware)

Registry information for Add/Remove (Programs and Features)
Freeware - ARPCache Viewer
ARPCache is a secret, undocumented section of the registry used to store
information for Add/Remove Program items in the latest versions of Windows.
If you open Add/Remove Programs in the newer versions of Windows, you will
notice that certain information has been added, such as, size, frequency of
use, and last used on. This data is kept in binary files in the ARPCache of
the registry, which means that even if you know where it is in the registry,
you probably will not be able to read it. ARPCache Viewer deciphers the
binary files and shows you what is in each entry

DextrousDave · 17 May 2012

Thank you for the answers. Appreciated.
@Jacee. Why would the other computer poison my ARP cache and what implications does it hold should the poisoning attack be successful?

UsernameIssues · 17 May 2012

Not to answer for Jacee, but here is more than you ever wanted to know about ARP cache poisoning.

Did the other computer get scanned by ESET?