false IP reading

I have a major problem. I am getting false IP readings,
and I do not know why. I am on windows 2000 pro,
and I have the following software programs that I use
for security purposes.

1.) hijack this 1.98
2.) host admin
3.) the cleaner (newest version)
4.) spybot 1.3
5.) ad-aware pro se 1.05
6.) active ports
7.) fix-it utilities

I was on the phone with teir 2 tech support from my isp,
and they told me my IP number was different
than what I was seeing. I even typed ipconfig
in DOS command and also went to a webpage
to confirm my IP number yet the number still
revealed the same. (different from what my isp told me)
We even reset my modem, but the same IP was revealed.

The IP that shows on my system is not a proxy IP
it is my original ISP IP from 2 days ago, but after
I tried to release and renew that IP it indicated that
it did not renew, but it actually did. It still indicates
that it did not renew. That's the problem.

1 last note: when I run hijack this I get an R1 catagory alert
indicating this reg key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyOverride= <local>

In conclusion the tech support suggested that I do 1 of 3 things.
1.) reinstall windows 2000 pro (too time consuming)
2.) reinstall the drivers for my network adapter. (which I do not know how to do)
3.) remove the network adapter from the hardware device manager, and let it reinstall itself.

I have not tried either 1 of those 3 options yet.
I am very confused and unsure as to what to do.
Can anyone help please ?

are you having trouble connecting to the internet.

Why not try
ipconfig /release and renew
at the command prompt

If you are behind some kind of router...your computer will have a different IP then what the ISP is giving you....
Reset your router\modem (power off\on) that should renew your IP with the ISP

Why not trying to remove the "culprit"
Looks like it masks your IP addy..as an anonymous web server?????
See if that fixes it??

MLF

I am sorry, I do not understand your "problem" can't you connect to the net or something?

CAWS uses proxy servers, so I would expect you to have a different address from that given to you by your ISP...........otherwise it isn't working?

just a thought

thanks for your reply. in answer to your questions. no i am not having problems connecting to the internet, and no I do not have any router. The tech on the phone had me reset the modem on a complete shutdown yet the same IP was displayed. Also I did try to release and renew the IP which did in fact work, but I had no knowledge of it working. (make sense ?)

By the way I have all of the most windows security updates installed as of last night, and also I am not connected via USB port I am connected directly via nic card to pc.

hmm I may try uninstalling CAWS, but I am a bit skeptical that it will help, but ok wow I just scanned my system with ad-aware pro and I got 24 items from 180 solutions that were deemed critical objects. eep lol .. k now I am starting to wonder. I'll repost in a few minutes to see what's up

yes I understand the concept of CAWS, but the thing is I am not running the program. The IP that shows on my system was not a proxy IP it was my original ISP IP from 2 days ago, but after I tried to release and renew that IP it indicated that it did not renew, but it actually did.
understand ?

when i run hijack this i get this R1 catagory alert: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyOverride= &lt;local&gt;

uninstalling CAWS proved to be futile. My IP is still revealed as something it's not. I even went to 2 different webpages.

1.) http://www.pcmesh.com/ip-check.cgi
2.) http://www.showmyip.com/

plus ran ipconfig again in my DOS cmd and it stays the same.

the bottom line is I see my IP as for example 68.104.xx.xx
(i used the x's as an example)
but my actual IP is 24.xxx.xx.xx (something)

so basically I cannot see my real IP. It won't let me for some unknown reason.

Hmmm,

Did you re-boot after uninstalling CAWS?

Are you connecting via dial-up DSL?

Have you tried running traceroute to something like microsoft.com?

Have you tried whois to find out more about the strange address?

A handy tool to have is Sam spade v1.14...........it is free :)

Cheers

nihil thanks for trying to help me i really appreciate this. to answer your question yes i did reboot after uninstalling CAWS. I am on cable (not dsl or dial-up)

I have not tried a tracer route yet although that sounds like a good idea.

i have an idea and that is i want to email a friend and see what IP they see for me in the email, but my friends are not online at the moment, however i will know more later on today hopefully.

in regards to sam spade 1.4 i have never heard of it, but i will definitely see if i can download and install it here very shortly.

thanks again nihil. i will post again later when i know more.

OK you are welcome. I am afraid it is not my area of expertise other than having "come across things" like yourself.

Sam Spade has all the tools (well the basics) in one package so you can do traceroute, ping, whois and so on from the same tool/GUI (I know you can do it from the command line, but why bother :D )

I am over in the UK so things may be a bit different, With my dial-up 56.6 and DSL connections I get a new IP every time I log out and back on. With cable the address tends to be static, perhaps there is some delay before the change is implemented by your ISP............or their records are updated, hence the suggestion of traceroute and whois.

I will look for a link to Sam Spade 1.14 and edit the post

Good luck

EDIT: here is a link:

http://www.samspade.org/ssw/

Sorry you will have to copy & paste, as this is an edit to a post

Hmm so you already resetted the modem... supposedly by unplugging it [if not try that].

If the ISP sees your proper IP [although you shouldn't get new IPs on cable in most parts that I know] then the only thing I can htink about is connection hijack, so I would do a traceroute ASAP and see what awkward IPs that gives you.

Alternatively you could try downloading something like Knoppix LiveCD and see how that works [ifconfig would give you your IP] and in case you get the proper one then I assume something's wrong with Win. Run an AV program, Google for that HJT output... If however you get the same ip then either your ISP cache is at fault or... something else that I didn't think of.

I would also ping the IP you should have and the one you do have and see how that works, eventually try and traceroute those aswell... see to whom the IP belongs to [if it's not your ISP] and if the problem persists send them an e-mail.

Keep us posted...

Quote:

---

by nihil

I am over in the UK so things may be a bit different, With my dial-up 56.6 and DSL connections I get a new IP every time I log out and back on. With cable the address tends to be static, perhaps there is some delay before the change is implemented by your ISP............or their records are updated, hence the suggestion of traceroute and whois.

---

Your cable IP address probably has a longer lease time on the DHCP than the dial up lease time. This would make sense if you consider the duration of connections, i.e. dial up short and cable long ("always on"). You may have noticed that occasionally it changes, but not very often.

The DHCP lease time for the PC's where I work are set to 21 days. So if they do not connect to the DHCP server in 21 days, then the very next time they connect they may obtain a new IP address, but only if the one previously leased to them has been re-allocated to a different PC.

Wow - long sentence. Does that make sense?

If not click here. Or click there anyway! lol

Quote:

---

Originally posted here by Simple Simon
Your cable IP address probably has a longer lease time on the DHCP than the dial up lease time. This would make sense if you consider the duration of connections, i.e. dial up short and cable long ("always on"). You may have noticed that occasionally it changes, but not very often.

---

The way I understood it is that the ISP sees he's been given a different IP address then what he is able to see for himself. In that case it's not a DHCP lease time IMO.

I was referrring to nihil's situation not isle_of_infamy's. I didnt't make that very clear did I?

When I read what I typed, it seems a bit garbled! lol

Did I get it totally wrong?

Ok.... Let's go back to basics.... You are saying a lot about the IP's being different..... I want you to post them please. But before you do that I need you to think a bit.

If both the IP's start with the same two octals, (ie: 67.65), then place x's for the numbers in the first two octals so 67.65.125.34 would become xx.xx.125.34.... OK?

If the first two octals are 192.168. or 10.x or 172.1 through 172.16 then post them in full.

Then make sure that you show the subnet mask for both the IP's.

Without knowing the IP's, or at least a close approximation of them we are all really "shooting in the dark".....

isle_of_infamy,
I've never really experienced this type of problem so I can offer only limited advice.
Are there any boxes checked under:
Internet Properties-->Connections-->(Highlight your default connetion) and click on the Settings tab-->Proxy Server
(OR)
Internet Properties-->Connections-->LAN settings-->Proxy Server

I know it sounds pretty simple and somewhat stupid but, I'm just starting with the basics.
Also, there's this quick little website test you can run to see if it detects any Proxy Servers in use:
http://www.proxyinfo.co.uk/check.php

ok for i guess my ip was my ip afterall but for some reason my cable company didn't know what my ip was. how stupid is that ?

did you ever try ping'ing or doing a tracert on both IPs? I would think that if you did have an IP problem, ie spoofed, etc. that you wouldn't be able to get on the net because your request would be lost aand if you tried pinging it should come up as"request lost" because of that. I have seen similar things done in trojan programs that do DrDos attacks. They work by spoofing the IP address of the target and then send a flood of ping request to a router and thus the router sends it back to target IP and makes it a very clever, but very hard to trace attack.

Shugart-

Quote:

---

ok for i guess my ip was my ip afterall but for some reason my cable company didn't know what my ip was. how stupid is that ?

---

Well, with the usual reservations about being in different countries :)

1. Because cable companies do not change your IP very frequently, they may not update their records that frequently either? And I am willing to bet that customer services/tech support are at the bottom of the information foodchain.

2. I have known it that when an ISP has had problems they have temporarily "rented" bandwidth from apparent rivals.............antitrust? ho ho ho

Grab yourself that tool I suggested and do a bit of investigating.

Cheers

In any case, the confusion may be that likely there is a significant latency between the assignment of the IP at the client side, and the update of the DNS records on the support side. So, the query run by the support person probably picked up whatever was in DNS cache at the time.