Why does my DNS change (and break) at regular intervals?

Question

I have a laptop running Windows 7. Up until recently, everything was fine. We have multiple devices in my house connecting to the one access point with no problems. No issues with ISP. Now my Windows 7 PC DNS settings change every minute or so.

Before the problem occurs if I do an ipconfig /all I have two DNS settings (primary/secondary) and everything is fine.

After a short period of time this change to a sole DNS, 10.0.0.1. Webpages no longer resolve.

If I do an ipconfig /renew, this fixes the problem.

I have tried uninstalling various programs I thought might be related but the problem persists. Any ideas of potential causes?

Answer 1

Unexplained DNS setting changes are very alarming because it is one of the most popular tactics used by malware to redirect its victims.

Changing the DNS settings also requires Admin Privileges. Considering this is a home computer, I further suspect this could be either malware or a very poorly written program.

But changing to 10.0.0.1 is a very very odd setting.

After checking your computer for malware, I'd next trim your startup processes or at least list them in a text file for others to examine for possible misbehaving 3rd party processes.

Answer 2

Since you're getting your IP address and DNS settings from DHCP server, it is possible there is a "rogue" DHCP server active on your network, created either by mistake or maliciously. And these DNS settings are being sent by that DHCP server.

Once this DNS server change happens again, do ipconfig /all and look at the DHCP Server entry there. Check that it is indeed your DHCP server's IP, and not some other IP.

If you have any additional routers (wired or wireless) on your network, make sure DHCP is disabled on all but one, which provides your Internet connectivity.