Networks

Ask something
Discussion Locked

Server has different IP address...

0 helpful
7 replies

by peejay

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

To whom it may concern:
Our company network was hit hard with the NIMDA virus! We are taking care of the infected files, but I'm not sure it if has done some other damage. We use a proxy server to allow everyone internet access. Our proxy server used to have a certain IP address. You could go to internet tools under internet explorer and then go to connections. For the proxy server, you could either type in the name of the server or the IP address and both would work fine. Now if you try and access the net with the server name for the proxy, it doesn't work and at the bottom I see "finding site 195.xxx.x.xx" and it's a totally different IP address. If you enter the correct IP address for the connection, then it works fine. Some users also can not access their microsoft exchange accounts and we think that this problem is related because our exchange server runs on this same server. I checked the server and the correct IP address is specified for it. Why is it that if you specify the server name now it looks for the wrong IP address even if the machine's network card is specified for a totally different IP? Please help. (If I had more points to give, I would...)

Thanks,
P. J. Peterson

7 replies

by magetower

1. If running WINS make sure WINS database shows correct entry for the server.

2. Use nslookup to determine if DNS shows the correct address.

3. Make sure the settings haven't changed on the systems to use the LMHOSTS file. Check the lmhosts file for entries that may have been added.

by estebandelatorre

Check fort a route illegally defined using the route print command. If you find something strange, just delete de route (route 12..12.1. delete)
Use nslookup to verify correct dns name resolution.
Also there's a good withe paper here at techrepublic about this virus.
Search for "Nimda worm"

by peejay

Sorry for the late response, but it WAS the route table... Thanks a lot!

by mike (from canada)

Try to make everything automatic. for example, make sure "server assigns ip address" is enabled so you wont have to type any values in. Also, It is recommended to have an absolute IP address so that ALL browsers will work correctly. Netscape 3.x andarachne internet for dos require fixed DNS addresses. The more absolute you are, the more you know what the program is doing and therefore track down problems easily.

This discussion is closed to new replies.