Virus Activity...?

[Bindumadhava.V]

Hello,

In some of our machines, gateway ip address in Windows machines, automatically ip address was changed to some other ip... and the endusers are not aware of any such activity...and virus defn files are uptodate and realtime virus scan is also enabled...

Any idea..how this could have happened...?

Thanks & Regards
Bindumadhava.

[Ron Kinner]

I need a bit more information. When you say the gateway IP address changed did the Default gateway address in the TCP/IP setup change or how did you determine that it is using another gateway? Does the other gateway work or is it completely bogus. Are you using DHCP or static assignments. If DHCP did the IP addres assigned to the box also change? Does the new number start with 169? What operating system are you using? Do the PCs have more than one NIC?

Without more info my guess would be your DNS server failed or is sick or has network problems and is not responding to requests reliably. ipconfig /renew should show if the box can talk to the DHCP server.

Ron

[Bindumadhava.V]

Hi Ron,

Thanks for the reply, Here is some more info on this....:

* All the machines are using static ip address and no DHCP lease..
* Gateway address that is changing is in the tcp/ip properties - gateway.
* As these machines were not able to connect outside the subnet, we could figure out that is using wrong gateway & which is not completely bogus, some were like adding one extra number to the first octet of the gateway address etc..

Please let me know if you need more details

Regards
Bindumadhava.

[Ron Kinner]

Sorry, I missed this when you replied to my question. Do you still have the problem?

Are the sick machines all the same operating system? What version? Service pack level?

There is a bug in NT token ring which does something similar:

http://support.microsoft.com/default.aspx?scid=kb;en-us;243468

Have you installed any new programs recently? The gateway IP is stored in the registry. I suppose it is possible for a poorly written program to accidentally mess up a registry entry.

Ron