Some DNS problems are accidents. Some are not. Software that profits from your clicks has a long history of quietly rewriting DNS and proxy settings — and the check takes ten minutes, on your PC and on your router.
Most pages in this series assume your settings were changed by accident, by an update, or by you. This one covers the darker possibility honestly: malware and bundled junk software deliberately change DNS servers and proxy settings, so your lookups pass through a machine that can redirect sites, inject ads and observe your traffic. The fingerprints are recognisable — DNS addresses you never set, a search engine that is not yours, results that detour through strange pages. Work through the audit in order: the PC's DNS values, the router itself, the proxy settings — then clean, reset, and verify the tampering does not come back.
One oddity can be an accident; a cluster is a pattern. Take this page seriously if several of these are true together: websites redirect or detour before loading, extra ads appear on sites that never had them, your search engine changed itself, the browser warns about certificates on familiar sites, or — the most technical and most damning — your DNS servers are addresses you cannot account for.
Also note the quiet variant: everything works, nothing looks wrong, but a DNS entry appeared that nobody set. Surveillance pays better than vandalism, so do not require visible damage before checking.
Run ipconfig /all and find the DNS Servers line for the adapter you use. Now judge the values against a short innocence list: your router's address (for example 192.168.1.1), your ISP's published resolvers, or a public pair you deliberately set — Google 8.8.8.8, Cloudflare 1.1.1.1.
Anything else — especially unfamiliar addresses in a connection that should be automatic — is a red flag. Search the exact address from a clean device (your phone on mobile data) if you want its reputation. Then check the adapter's IPv4 properties: if DNS is set to manual and you never set it, the tampering is already proven; the only question left is what else was touched.
Sophisticated tampering skips the PC and rewires the router, which then hands poisoned DNS to every device in the house — and survives every PC cleanup, because the PCs were never the infected part. Routers get in through unchanged default admin passwords.
If every device in the house shares the strange behaviour, start here rather than on the PCs — the router is the one point they all have in common.
DNS is one lever; a proxy is the other, and tamperers pull both. In Windows, open Settings → Network and internet → Proxy. On a home PC, Use a proxy server should be off, and no setup script address should be present unless your ISP or employer put it there.
A proxy you did not set means traffic is being routed through someone else's machine — switch it off, note the address it pointed to for your records, and treat the machine as compromised until the cleaning below is complete. Also glance at the browser's own extensions: an unfamiliar extension with broad permissions can produce redirects all by itself.
ipconfig /flushdns so cached poisoned answers die immediatelyipconfig /all now — and again in two daysThe recheck is the verdict. If clean values hold, the job is done. If the strange DNS returns by itself, something resident is reapplying it — at that point back up your files and take the machine to a professional, because the infection is deeper than settings.
See every step on a real Windows PC — the tests, the commands and the DNS change, in order.
▶️ Watch Full VideoNot necessarily — 8.8.8.8 is Google's public resolver, and plenty of legitimate software, routers and well-meaning humans set it. The question is whether anyone with access to the PC did it on purpose. If nobody can account for it, reset it to automatic anyway and watch whether it changes back — a value that reappears by itself is the real warning sign.
Redirects that survive a clean scan usually live in settings, not files: the router's DNS, a proxy entry, the hosts file, or a browser extension. Work through this page's audits in order. If the router was the tampered part, PC scans will report clean forever — the PC genuinely is clean.
Only if its DNS fields will not stay corrected, or you cannot log in because the password was changed by someone else. A reset loses your ISP configuration and WiFi setup, so first try the gentler path: log in, correct the fields, change the admin password, update the firmware, and watch the values.