Wondering what changed DNS settings

[denis at hancock.id.au (Denis Hancock)]

you should switch auditing on your machines ?

On Wed, Jun 9, 2010 at 7:32 AM, Dave <d at securi-d.com> wrote:

> I've had that happen to me. I think it was Coldplay or something like
> that. I was very happy the firewall was blocking it :)
>
> Dave
>
> On 6/8/10, Tim Krabec <tkrabec at gmail.com> wrote:
> > I've heard of some malware that does this. I don't remember which
> > ones. Dns hosts lsps and proxy are all checked when I look at a machine
> >
> > On Jun 8, 2010, at 2:29 PM, "Gibson, Samuel" <gibsons at my.uwstout.edu>
> > wrote:
> >
> > > Hello,
> > >
> > > I found a Windows XP computer on our network that should recieve its
> > > DNS settings through DHCP but, recently realized that it had a hard
> > > coded DNS server address in the Ukraine.  Does anyone know of a way
> > > to find out any more information about when it happened or what
> > > changed it?
> > >
> > > Thanks,
> > > Sam
> > > _______________________________________________
> > > Pauldotcom mailing list
> > > Pauldotcom at mail.pauldotcom.com
> > > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> > > Main Web Site: http://pauldotcom.com
>
> --
> Sent from my mobile device
>
> --
> Blog: www.securi-d.com
> Podcast: www.securityjustice.com
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com



-- 
All the Best

TheMenace
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20100609/3b2522f2/attachment.htm