Windows 10: Can't get a ARP Spoofer off my PC

I got ARP spoofed by a unknown person trying to get into my PC. I turned on my PC which was slow and having internet connection problems. Avast antivirus tells me it is a “ARP spoofing attempt from XX.XX.16 to take my data transmitted to and from my PC”. I clicked the “disconnect and disable the connection” option. A few worked but other windows said “Sorry, we cannot execute this action.” Than, several Avast windows up pop up showing from more: XX.XX.10, XX.XX.17, XX.XX.22, XX.XX.27, XX.XX.44, XX.XX.236, XX.XX.252. Than from IP "169.254.174.164" several times. I think I accidently press the

:)

 

Hwid spoofer destroyed PC

Hi, I am Dave, I will help you with this.

There are two types of utility, a HWID Spoofer and a HWID Changer, they both change the HWID of the PC and will cause Windows to become deactivated, a spoofer usually does not permanently change the HWID, so it may or may not be possible to fix this if you used a HWID Spoofer, but the only method is to backup your personal files and clean install Windows 10 from a bootable USB.

Click this link:

https://www.microsoft.com/en-us/software-downlo...

to download the Media Creation Tool (Click on Download Tool Now), with that you can download the latest Windows 10 ISO (Select Create Installation Media for Another PC), you can create a bootable USB flash drive (min 8GB) using that tool

Then, Boot your PC from the Installation Media you just created (change Boot Order in your BIOS) to begin installing Windows 10

During the installation process skip the steps which ask for a product key and select the option 'I am Reinstalling Windows 10 on this PC'.

 

What do you think about this ARP attack log in my router?

@EOF

If you want to do some investigation first step is to note down known hosts on same segment.

Then run:
Code:

And make sure all IP entries match correct MAC entry that you gathered.

You could write a simple script that would compare ARP cache output against it's own list of dynamically mapped entries and report any IP\MAC discrepancies.

And if that happens, you could launch your own ARP discovery against bad entry to learn more about target host.
You could also simply block specific hosts in router or in case of wireless change WI-FI password.

 

Private IP Address in ARP Table That I've Never Seen Before?

every so often, I use the 'arp -a' command in CMD to check the IP addresses on my network, just to ensure everything is normal. I have 1 PC, 1 laptop, and 2 TVs which normally appear in the ARP table

today however, I've noticed an IP address in the arp table that I've never seen before on my Windows 10 PC. this does not appear in the arp table on my Windows 11 PC, and there is no matching IP in the list of devices on my router settings page

this 'new' IP does not disappear, and netstat doesn't seem to show anything suspicious from what I can see. I do have an idea of what this might be but I'm not very knowledgeable on this and would like some confirmation

on my PC, where this IP is appearing, I did "ipconfig /all", and I noticed that the Physical Address listed next to the IP on the arp table is identical to the Physical Address of the pc's Wireless LAN Adapter Wi-Fi

the wireless wifi is in a "Media Disconnected" state, and always is, because I use an Ethernet connection, rather than wireless (only on my PC, my laptop is Wireless)

so could this simply be a glitch or error on the system's part? listing the wireless wifi LAN adapter on the ARP table? I'm not sure why it would do this because it says the media is 'Disconnected' and I've never seen this before

however, I do know that sometimes, on startup, in the NetworkProfile logs in Event Viewer, there will be an ID 10000 event that lists the network name as "Unidentified network", before being replaced by a new 10000 event which displays the network as my Wifi's normal name

I'm wondering if it's possible that this IP address, with the Physical Address of the wireless wifi adapter, appearing in the ARP table may be linked to the "Unidentified network" event in Event Viewer

"Unidentified network" doesn't occur on every startup, only occasionally, and someone suggested that it may be caused by the fact that I use an Ethernet connection, so the computer may sometimes mess up identifying either the Wireless or Ethernet adapters at first (they weren't sure which)

so is it possible that this Wireless Wi-Fi LAN Adapter's IP address in the ARP table may be appearing due to this, and that I've simply never done the "arp -a" command on a session with the 'Unidentified network' events before?

can anyone share their thoughts on this? do I have any reason to worry? Windows 10 22H2, fully up to date