IPv4 DNS addresses spontaneously change

martymax · 24 Apr 2016

Recently, I lost the ability to log onto the internet through a wired connection. After some effort, I finally determined that for some reason, the IPv4 DNS server address for my controller had spontaneously reset to 146.148.119.121 preferred and 104.130.169.74 alternate, from “obtain DNS server address automatically”. I reset to automatic… and was immediately able to log on. Since then, this spontaneous reset thing has happened again and again and randomly-sometimes on a reboot, but not always. It has always reset to those same two addresses. Throughout this, my NetGear R7000 router continues to be set to “obtain DNS server address automatically”.

I did check my registry and found these two addresses buried under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{87B42038-AC88-4D5E-A483-6A7974C7EE22}\NameServer\....

Is it safe to change these addresses from their stored values to 8.8.8.8 and 8.8.4.4, the Google DNS addresses? Any idea how these two odd addresses might have gotten populated in the first place?

Ztruker · 25 Apr 2016

I would be concerned about malware. Run a full scan with your anti-virus program (in Safe Mode if it allows it). Also download and install Malwarebytes Anti-malware and do a full scan with it. If still problems, I suggest posting on one of the sites that have some good malware removal folks, like:

whatthetech.com
geekstogo.com
spybot.info

or many others.

Chamsalot · 30 Jun 2016

martymax said:

I finally determined that for some reason, the IPv4 DNS server address for my controller had spontaneously reset to 146.148.119.121 preferred and 104.130.169.74 alternate, from “obtain DNS server address automatically”.

Any idea how these two odd addresses might have gotten populated in the first place?

Yes. After freaking out last night thinking I had been hax0red, I googled the IP addresses (which appeared for me as well in my network adapter settings) and happened upon your post. It turns out this behavior was caused by NordVPN. I suspect that if you had NordVPN on your PC, it too, was the culprit.

I hope this delayed response makes you feel better. If, OTOH, you already nuked your hard drive from space (it's the only way to be sure sometimes), then nevermind.

For posterity, currently NordVPN is also using DNS Servers 78.46.223.24 and 162.242.211.137. If these appear in your TCP/IPv4 DNS server settings and you have NordVPN, I would not be alarmed:

-[Ch]ams

martymax · 30 Jun 2016

Even though I did indicate that this issue was solved, turns out it wasn't. Periodically, DNS gets reset (same numbers as before) and I simply reset it (still bothered me not knowing why though). Now the two DNS numbers I quoted (146.148.119.121 preferred and 104.130.169.74 alternate) are IPS's from valid companies (Google Cloud and RackSpace I believe) so were certainly not scammers. I do have NordVPN on my computer, so expect that your explanation, Chamsalot, is right on the money. Thank you for the info and I will continue to monitor. I called NordVPN and they advised me to deselect Smart-Play in the settings box (explained that Smart-Play has problems and should NOT be selected). I deselected and we shall see if problem gone. Thanks for the clue Chamsalot.