Malware·2,772 discussions

Where did IP 169.254.51.183 come from?

Locked

My boss brought in his home desktop saying it wouldn’t go out on the internet. Another desktop in his house and his laptop find the internet just fine. So, I’m looking around in Windows XP Pro and notice that the NIC is set to obtain IP Address Automatically but the address assigned isn’t witin the private IP range for his house (router). What’s more weird is that the desktop is now on my workbench, inside our company private network, and it still shows that same IP Address making it look like it was automatically assigned by the company router. But our company trusted network doesn’t use that IP scheme either.

Does anyone know where this IP Address 169.254.51.183 came from? Maybe some spyware or virus? And why the heck can’t I get it to release the dang thing?

Thank you.

Lloyd
LLouks@AshwoodFinancial.com

Topic

Clarifications

In reply to Where did IP 169.254.51.183 come from?

Clarifications

APIPA

In reply to Where did IP 169.254.51.183 come from?

The 169.254.x.x range of IP addresses is reserved by Microsoft for private network addressing. If you have a pc set to automatically obtain an IP and you recieve one of these addresses, windows has assigned this because it cannot find a DHCP server within the network subnet. Check to make sure your DHCP server is functioning correctly. If you do not have a DHCP server, you will need to manually set an IP configuration.

DHCP is working fine

In reply to APIPA

The DHCP on our company network is working fine — the entire network is just swimming along. But I guess that makes some sense about where the IP comes from. Now, what area should I look on the affected PC to find out why it can’t find the DHCP server?

This whole thing started because the PC couldn’t find the internet. My boss brings it in here for me to fix.

The LAN connection is working and Status shows that it connected at 100.0 Mbps, I even tried putting in the gateway address of our router/DHCP and it still can’t find it.

This is just too weird.

Lloyd

Couple of suggestions

In reply to DHCP is working fine

Do you have a test network that you can plug this into rather than your company network? There’s a chance that this may be a virus/spyware infection and you probably don’t want to be bringing this PC onto your company network if that’s the case.

If you do have a safe test environment try bringing this online using a static ip instead of dhcp. If this works then check that the dhcp client service is started. If it is, enable dhcp again and do an ipconfig /relese and /renew. If you’re not getting an ip address check the event viewer for errors.

If you can’t get a good network connection with a static ip or the above doesn’t work then reinstall the network card driver. If this doesn’t clear it, remove and reinstall tcp/ip.

I’d be wary of putting this on a company network until it had been thoroughly checked for virus/spyware installations.

Most likely a Virus

In reply to DHCP is working fine

Yeah, these guys are thinking along the right lines, I’ve gotten three of this same problem in the last couple of days. It’s always caused by a virus and it corrupts some part of the tcp/ip configuration. Scan for viruses, get them all cleaned up, then try a windows repair w/ the disk. Otherwise, just back the stuff up and format it. :]

did you try release and renew that DHCP address?

In reply to DHCP is working fine

ipconfig /release?
ipconfig /renew?

Home network router

In reply to Where did IP 169.254.51.183 come from?

As this system is doing the same thing on a different network, Check the firewall first (could be set to block all). Next, I suggest uninstalling the NIC driver in the Device Manager. Afterward, shut down the computer and do a power reset by unplugging the power cord, then pressing and holding the power button for 30-45 seconds. This will allow the transistors to reset to their default positions. Plug the system in and turn it on. Windows should install a clean copy of the driver onto clean circuits.

If this is does not get you a good IP address, try booting into Windows Safe Mode with Networking. Once in, check the IP. If it is still showing 169.254.*.*, there may be a problem with the NIC. Try a known good NIC. If it gives you a good IP from your network, there may be something starting in Windows Standard mode which blocks access to the network in general.

Firewall gone missing

In reply to Home network router

Thanks, I’ll try that.

I just noticed that the firewall has gone missing. Not in network properties nor control panel.

I may have to reinstall Windows from scratch.

Thanks again.

Lloyd

TCP/IP stack maybe corrupt

In reply to Firewall gone missing

Try removing and reading the TCP/IP protocol stack & the NIC driver.

Spyware Guard 2007 Through 2009 Can Do This

In reply to TCP/IP stack maybe corrupt

For others who are looking for an answer, as I was, I finally cleaned this off the affected system, but apparently it destroys your previous connection pretty effectively.
The result is exactly what’s described here. You lose Internet, network and e-mail, if you’re using anything like an Exchange server.
My particular problem was Spyware Guard 2008, which installed while I was on vacation, either through a shared folder or as a drive-by ActiveX installation from a trusted Website.
This was despite several safeguards I had in place, so the following were useless against it: Lavasoft, AVG, Spybot and Computer Associates eTrust.
The only thing that would even detect it, let alone remove it, was A-squared’s Anti-Malware Free. Every attempt to remove it with the others was a waste of time. It would always come back even when removed in Safe Mode.
Removing it seems to have wiped out my NIC driver or caused something that requires reinstallation of the OS, though. All attempts to re-establish reception failed, but transmission still functioned. The IP address could be changed from the 169 Windows default to a known good address, but still nothing.
Very strange.

It assigns a APIPA address

In reply to Where did IP 169.254.51.183 come from?

Hi Lloyd,

since,Your system’s NIC is set to obtain ip address automatically.It will get ip from dhcp server or it will assign itself as APIPA address (Automatic private iP Address)
from range of (169.254…..) incase ,your dhcp server failes to assign the ipaddress to the client.

[Author]

Replies