DNS being reset

[paulvernon63]

My Server 2003 machine appears to be having it's network card DNS address set to 8.8.8.8 and 8.8.4.4. I know that's google dns but I haven't set the card's dns to that; we use SEGfL / RMs forwarders, 62.171.198.104 and 105. Is it possible that a virus / malware infection could be causing this? Can I monitor this in event viewer; what would be the event ID?

Regards,

Paul Vernon.

[Gibson335]

Sounds to me like a botnet attack.

[Geoff]

That's a symptom of the TDSS Rootkit.

 

TDL4 – Top Bot - Securelist

[sonofsanta]

hack hack hack, check your firewall ports & close them down, check your security logs, assume that server has been compromised.

[Gibson335]

Yes, and I hate to say it, but change your admin password - or at least give it strong consideration.

[andydis]

lots of malware does this too, check for the normal :

 

startup entrys you do not recognize, unusual services, you could try tea timer from spybot to find out what changes the setting.

check your local users passwords