I have a strange issue that popped up last week. All of a sudden three (3)
network devices (XP Home, Win 98, and a printer) show up in my dns local
cache pointing to jomax.net dns servers. All three of these devices have the
proper records in my DNS server, and DHCP server. Why would they show up in
the server cache pointing to an external address? I have run virus/antivirus
(all negative), checked the workstations for misconfiguration (all NICS set
to obtain DHCP settings), host files, etc. I have never seen this before and
am extremely worried that my network has been compromised in some fashion. I
have a firewall (Checkpoint SOHO 500) that blocks attacks all day long, only
one incoming port is opened for the phone system.
Anyone have any ideas on where to look next? I'm stumped