Endpoint Protection

The DNS server on this computer automatically change to the IP 8.8.8.8 (DNS primary) and 8.8.4.4 (SECONDARY DNS), The DHCP server does not exist on the network, the IP configures manually, even so the DNS is automatically placed above. .. help please

what do u get after

ipconfg /release

ipconfig /renew

does it give you same dns server name?

If the DNS is manually configured then it will not change. Double check if the DNS is manually configured or is picking up from your Router etc.

Also check the host file if you see any unknown entry.

Do a nslookup and see if you are resolving the correct dns server or not.

Hi,

some viruses play with the DNS settings.

If a full scan with latest rapid release definitions won't detect it, isolate the malicious fine and submit it to Symantec.

Just so you know, both 8.8.8.8 amd 8.8.4.4 are Google's publis DNS servers.

Someone manually configured these, perhaps because they provide better security.

If it is against policy, I would tell the user to stop. Oherwise, you can use SEP 12.1 to block this ability.

I actually use these for my home browsing...

You can refer to this write-up

http://www.symantec.com/security_response/writeup.jsp?docid=2011-031106-4835-99&tabid=2

W32.SillyFdc.bdp

If the worm finds that the newly compromised computer is using the poisoned DNS IP it is sending through DHCP, it resets it to the following Google Public DNS IP address:
8.8.8.8

thanks for your comments, scan files manually in system32 and found a unusual .exe,  for there to delete it and solved the problem...