Puzzled: Extra 'ghost' IP address

Hi,

I'm puzzled. I have Windows 2003 Sp1 with a single network card, that
has -no- extra TCP/IP addresses defined.
It has a static address of 192.168.0.7.

Further on, this server, is not part of a cluster or never had been.

Anyway, since a few days, it assigns (how???) an extra dynamic address on
the -same- NIC such as
192.168.0.22

arp -a reveals that it is really -the same- MAC address that has been bound
to 192.168.0.7.

Secondly the DNS server, reveals that 192.168.0.22 has been registered as
well.
So nslookup
[myserver as input]


returns
192.168.0.7, 192.168.0.22

In addition, I can have all traffic such as HTTP and RDP (and others)
through this mysterious IP address except SMTP, which does not 'like' the
new address and disconnects with an exception.

Is this a virus or keylogger or what is it?

Regards

"Egbert Nierop (MVP for IIS)" <(E-Mail Removed)> wrote in
message news:%(E-Mail Removed)...
> Hi,
>
> I'm puzzled. I have Windows 2003 Sp1 with a single network card, that
> has -no- extra TCP/IP addresses defined.
> It has a static address of 192.168.0.7.
>
> Further on, this server, is not part of a cluster or never had been.
>
> Anyway, since a few days, it assigns (how???) an extra dynamic address on
> the -same- NIC such as
> 192.168.0.22

After a long search, it seems that routing and remote access has assigned
this extra address.
Why this happens is still not clear.

Answered in win2000.ras_routing newsgroup.

Egbert Nierop (MVP for IIS) wrote:
> "Egbert Nierop (MVP for IIS)" <(E-Mail Removed)> wrote in
> message news:%(E-Mail Removed)...
>> Hi,
>>
>> I'm puzzled. I have Windows 2003 Sp1 with a single network card, that
>> has -no- extra TCP/IP addresses defined.
>> It has a static address of 192.168.0.7.
>>
>> Further on, this server, is not part of a cluster or never had been.
>>
>> Anyway, since a few days, it assigns (how???) an extra dynamic
>> address on the -same- NIC such as
>> 192.168.0.22
>
> After a long search, it seems that routing and remote access has
> assigned this extra address.
> Why this happens is still not clear.