>I believe we have found 1 customer that is infected with a botnet or malware.
I've dealt with plenty of botnets working as a repair technician in the past but never had one change the public IP address of the user. Not entirely sure what this would accomplish aside from making it much easier to detect.
