2

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes.

So we took a look with the wireshark and it seems like my computer is infected with something that keeps asking my IP to modem. It is something called "Azurewav" (I don't have any hardware or software that is related to neither Azurewav nor Azurwave)

Although its not broadcasting all the time, the thing that its asking modem every second about my mac address seems to be the problem about our connection lost. I'm not very experienced about this but pushing too many requests to modem may cause this (if other computers are infected too) IMHO.

Here is a screenshot from wireshark. I've put the known IP's as static but it keeps continuing somehow.

I'm using Windows 7 - 64 bit Ultimate. And connecting through wireless.

wireshark capture

To sum up, my computer is doing some arp spoofing attacks without my will. How can I stop it? If it must be done with a software please share a free one. If it can be solved by deleting the malware by some scans or etc.. It would be much appreciated

10
  • You can afford a W7-64 computer, but you can't afford decent antivirus software? (AzureWave is the brand of your wireless adapter, BTW.) Apr 25, 2012 at 12:05
  • Yes about that, I'm a student so W7-64 comes free. Azurewave is not the brand I did have a look for it but I couldn't find anything related to that company. That's why I noted (I don't have any hardware or software that is related to neither Azurewav nor Azurwave). Thanks for the reply!
    – umutto
    Apr 25, 2012 at 12:07
  • Odd, it was at the top of the list when I Googled it. They make wireless adapters for laptops. Apr 25, 2012 at 12:08
  • Yes, I did & thought the exact same thing too but I couldn't even found their brand name on my hardware when I opened it up. The thing is if you search for "Azurewav" on google you can see some people also suffered. Maybe I accidentally installed their drivers?
    – umutto
    Apr 25, 2012 at 12:11
  • Open Device Manager and look at your Network Adapters. What's your wireless (WIFI) adapter called? Apr 25, 2012 at 12:11

1 Answer 1

3

I don't see any sort of "spoofing" or "poisoning" here.

The first part consists entirely of query packets. Some routers periodically send ARP queries to the entire subnet in order to refresh their "Connected computers" list, but although I have never seen a Windows 7 computer do this, it isn't harmful by itself – unless it reaches thousands of requests per second; your capture only shows ~256 packets. Do check "Network Discovery" settings, though.

The second part is just normal ARP queries and replies. Your router is asking for your computer's address every 30 seconds, which is fairly normal for ARP – and the computer's replies contain legitimate information.

Azurewav stands for "AzureWave Technologies" according to /usr/share/wireshark/manuf. It manufactures Atheros WiFi adapters commonly found in laptops.


Note: ARP is not related to the "DHCP" vs "Static IP" setting; ARP requests will be sent in either case.

3
  • Thank you! Actually I've seen the first part only today, I thought it was interesting and wanted to share. Will check the "Network Discovery". And about the second part, I've checked with one of the other computers in my network and it didn't do that every 30sec or faster. So I was pretty sure it was ARP poisoning. Thanks for the info. So to sum up can we say I'm clean?
    – umutto
    Apr 25, 2012 at 12:25
  • @umutto: The first part is rather unusual for me, but queries are definitely not harmful. How often are the mass-requests sent, though?) Apr 25, 2012 at 12:30
  • Thank you for the answer again! I've changed my network discovery settings in anycase. First part was temporary I've been monitoring for 2days and its the first time I saw it, It was interesting so I put that also. Thank you!
    – umutto
    Apr 25, 2012 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .