Anyone trying to share my internet.I have reformatted my C drive several times and scanned by ESET, KIS and Malwarebytes but these programs didn't find the hacker's virus.The ESET firewall 5 repeatedly blocked ms.homenet 192.168 IP by reason ARP cache and DNS cache attack but it also didn't stop the attack so i uninstalled the ESET and installed Comodo Firewall and NOD AV.
What was the full IP address that you mentioned here? Can you see if that IP address is of your router?
I am not familiar with Eset. But if it said it blocked then it blocked and did what it needed to do. Without having seen the full descriptions of that log and knowing more about what Eset exactly monitors it is hard to comment on these events. F.e if you are sharing your connection and somebody connects wireless then we can expect ARP traffic.
Normally my Local Area Connection uses the IP 169.254 and my PC connected to internet without any problem by using the IP 169.But last few days the Local IP switching from 169 to 192 automatically and after this the suspicious shared connection appearing on my PC .I use broadband internet and i installed Windows XP.
Being behind a router I would expect an IP address in the 192.168 or 10 range. Not in the 169 range.
Can you tell what your network set up is? What type of connection, what router are there other users sharing the connection? Are and others you connecting wired or wireless?
And Comodo detected that the system process with Local Port microsoft-ds trying to receive connection from internet when i disconnected my internet.Is it normal?
In the Firewall System is the instance that deals with sharing files and folders over the local network. It is normal that is listening at port 445 as well as others System is a pseudo process; it covers various functions in one instance.
I can't look process properties of some system processes on TCP View program by error "unable to query propertiers for system" despite i reformatted my PC several times.
That happens here too. Nothing to worry about. Remember, System is a pseudo process.
Their status is "listening" and may be they're a viruses?
A process listening is its self is not an abnormal thing. It is no proof of being compromised.
I can't terminate these processes by using "end" command.
What processes are you referring to? Notice that System in Task Manager cannot be ended. That is not a sign of being compromised
The hacker knows my IP and uses it for hacking. How to find the hacker's virus and stop hacking?
Edit by EricJH: I made a paragraph structure for an easier read
How do you know it is used for hacking? What proof do you have.
I am not convinced yet you are hacked.