[kevie]

In the past few days ipconfig.exe keeps asking for Internet access through ZoneAlarm. It didn't happen before.

Anyone has a clue? Is that something I should be concerned? I have recently updated to AdAware 6 but I am not sure if it's related.

[izx]

Don't worry, ipconfig is the Win NT/2K/XP tool for various network status info. What's interesting is that it's a command-line tool, so you must execute it before it asks for permission. Check if your ipconfig.exe in the \WINNT\SYSTEM32 or the \WINDOWS\SYSTEM32 directory is 49,664 bytes in size.

[kevie]

Thanks izx.

Before, ipconfig.exe only asked for access permission when I run it manually myself. Now, somehow either Windows or something initiates that command. That's why I am a bit concerned because it never happened before.

[izx]

Just make sure the real ipconfig.exe hasn't been replaced with a virus/trojan, and that only ONE ipconfig.exe (in the above mentioned dirs) exists. Strange!

[DrZoidberg]

sounds like a trojan or something trying to run it to get your IP address, as mentioned it shouldnt run on it's own.

[index]

I have AdAware 6 and it's not related - mine doesn't ask.
Did you do a virus scan? Also, run AdAware and download Spybot S&D and run that as well.
Also, look at when the creation date of the ipconfig file was.
I'm running Win2K, it's in the Winnt/system32 directory and it's 4.7 KB (35,600 bytes) big.
Both modificaion dates and creation dates are listed as
Tuesday, December 07, 1999, 12:00:00 PM

IF it's anything else (like creation date of last week) be wary run AV tools and the other programs to weed out the problem.
Lastly, make sure you AV Definitions are up-to-date.

[kevie]

From ZoneAlarm log, ipconfig.exe is trying to access 64.105.179.138:53, which turns out to be the DNS server of my DSL connection.

Name: h-64-105-179-138.SFLDMIDN.covad.net
Address: 64.105.179.138

It doesn't happen when I have the DSL connection using my laptop though.

And clue?

[HomeSlice]

Is that also your DHCP server? If so, it's just trying to renew it's lease.

Type ipconfig /all to see the servers, and ipconfig /renew to renew your DHCP lease manually.

[kevie]

Is that also your DHCP server? If so, it's just trying to renew it's lease.

Type ipconfig /all to see the servers, and ipconfig /renew to renew your DHCP lease manually.

DHCP is not enabled.

[dasnufus]

I'm not sure if its available in Zonealarm (free ver) but the Pro version you can deny ipconfig.exe from having access to the Internet (or any other .exe)