One evening a computer started to download several GB from a internet http
site. I have checked the computer for traces of who it could be(Documents and
settings, and ranked the last time edited). I brought in the computer to take
a look at it. I could not find anything on it. There had been downloaded
nearly 13gb from a internet site so it had to be stored some place. Stil I
cant find anything. I also checked out in event viewer on my domain
controller who had logged in this evening. I have checked out these users
what they have been doing, and "cleared" them.

I then started to take a look at my DHCP list. It shows that the computer I
brought in for a check had got this IP adress during the night(I saw this
when I looked up the DHCP lease time). I belive that the correct IP adress
may be stored in a old dhcp list. I have complete backup of my system, so how
do I restore a old dhcp list without confusing the one that is running today?

Best regards,
Håvard Kristiansen

--
Message posted via WinServerKB.com
http://www.winserverkb.com/Uwe/Forums.aspx/sbs-2000/200604/1

Re: DHCP by Håvard

Håvard
Thu Apr 20 04:04:53 CDT 2006

I forgot to type that I am running a Windows2000 SP4 network, single DC.
Using Symantec Backup Veritas 10.d backup software.


Håvard wrote:
>One evening a computer started to download several GB from a internet http
>site. I have checked the computer for traces of who it could be(Documents and
>settings, and ranked the last time edited). I brought in the computer to take
>a look at it. I could not find anything on it. There had been downloaded
>nearly 13gb from a internet site so it had to be stored some place. Stil I
>cant find anything. I also checked out in event viewer on my domain
>controller who had logged in this evening. I have checked out these users
>what they have been doing, and "cleared" them.
>
>I then started to take a look at my DHCP list. It shows that the computer I
>brought in for a check had got this IP adress during the night(I saw this
>when I looked up the DHCP lease time). I belive that the correct IP adress
>may be stored in a old dhcp list. I have complete backup of my system, so how
>do I restore a old dhcp list without confusing the one that is running today?
>
>Best regards,
>Håvard Kristiansen

--
Message posted via WinServerKB.com
http://www.winserverkb.com/Uwe/Forums.aspx/sbs-2000/200604/1