Virus? Remote access? Or normal process?

Norton Security | Norton Internet Security
1

I post this because as Norton is my security product and this showed in the Norton Logs, it may be appropriate for here. 

 

The  IP address provided by my ISP will change if I’m logged off the internet for maybe 30 minutes or more.

However, I had a “strange” occurrence last night and would like to check this with those who are knowledgeable about such things  

 

This morning I noticed that I had a different IP address. Strange since I did not log off the internet or reboot. I also noticed that my computer did not restart, meaning it never shut down to cause the IP to change(which I was NOT trying to do as I leave it on overnight for updates to windows, etc)

 Now this morning I look at the services log

and see that around 11:30pm central US time, my internet connection disappeared and then reappeared giving me a new IP address. and I think another similar set of numbers (192.168.1.64? the one that happens when your comp waits to connect to the internet) 

 

Mind you, I never rebooted or disconnected from the internet for this to happen. This all appeared to happen on its own.  

 

When I look at the connection log around that time, all I see is the 192.168.0.1 when the router connects

 

 

When I look at the firewall activity for around that  time I see this:

 Default Windows File Sharing Blocked 

Local- MY PC

 netbios-ssn (139)

 Services  

 

This happened Wednesday 10/14/09 and Tuesday 10/13/09 around 11:30pm US Central Time. I did install Microsoft updates on Tuesday before this happened  

 

Not sure what this all means?

Is that what caused my computer to reconnect to my ISP and get a new IP address?

 

Is it due to a virus/spyware?

Is this a sign of remote access?

 

 I ran a full Norton scan, Full Malwarebytes scan, Spybot and windows defender(quick scan)All came up clean

 

 Anyone else experience this since updating windows update?

 

I use a Vista OS with Norton Antivirus 2008 ( I will upgrade when 2010 hits the local stores)

 

again, mostly concerned if this Is it due to a virus/spyware or  a sign of remote access

2

This is a normal process of your ISP clearing the network at night.  They most likely saw little or no activity on your connection and moved it to do some internal (to their network) housekeeping.  You are clean and remained safe.

3

Thansk DBris

 

However, I use my computer daily and in fact on the nights in question, I had been on the internet about 30 minutes before the noted incident in question took place.

 

Does that make a difference? Or is it again just normal activity? Could it be that I had the same IP address for over a week and it needed to change then?

 

Interestingly, I was up last night and did not see this occur

 

But is it pretty clear that it is normal for the IP address to change without me rebooting or logging off? As I said, there seemed to be no disconnect from the internet requiring restart.

 

just want to be sure there is no monkey business going on

4

It's not 'normal' to have the address change, but it's not uncommon either. If you run "ipconfig /all" you'll see an entry for "Lease Expires". You have your current IP address until that time. Moments before your lease expires, Windows will try to renew your lease. Most of the time it succeeds and gets the exact same address for another day (duration will vary by ISP.) Sometimes, though, your ISP will give your machine a different address.

 

Message Edited by reese_anschultz on 10-19-2009 03:53 PM