Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have trouble using Panera WiFi, and I finally tracked down the problem:

Every time I reboot, Windows resets my TCP/IP settings for my wireless adapter to use a specific DNS server, instead of letting DHCP discover one.

How can I stop this from happening over and over again?

I have a suspicion that Tor/Vidalia/Polipo is doing this, but I their system tray GUIs are not set to run at startup.

Update: Specifically, my DNS settings are changed upon reboot to the following

Preferred DNS server:

Alternate DNS server:

This appears to be, a service of George Mason University, where I reside. Assuming this is just a persistent Windows setting and not spyware from their intrusive captive portal software (don't ask), how would I go about deleting this Windows setting?

I'm going to try a harsher resetting of the TCP/IP settings.

share|improve this question

You may be infected with the DNS Changer virus. Go to this site and it can detect if you are infected (the site is actually run by the FBI as they are the ones managing the Command and Control servers sense the people who wrote the virus got arrested last year).

If you are infected, the FBI is shutting down the servers July 8th so you will have no DNS after that date if you have not removed the infection.

share|improve this answer
mine is changing to it and i'm not infected according to that site – barlop Dec 16 '14 at 7:34

Tor or some software from the Tor bundles does not do this. Since Tor is working on application level (proxy) there is no need to modify adapter settings.

Maybe you also use (or have used) some VPN software or software for location based management of adapter settings? Some systems come with such software pre-installed. Perhaps the DNS server's PTR or WHOIS data give some hint which software is changing the setting.

share|improve this answer
Maybe Connectify is doing this. It's a program that lets you share your internet connection with other devices--I used it to root my Nook. But I'm not sure why it would need to change my DNS server in order to do this. – mcandre Jul 9 '12 at 4:59
I have never used this software but I think your guess is correct. I also have no idea why it does this. If you don't need this software anymore, I would just try if uninstalling helps. Remember that Windows XP and newer allow to create at least ad hoc Wifi connections and internet connection sharing without any separate software. See…. – Gurken Papst Jul 9 '12 at 18:56
The captive portal should work without any special software installed on your system so it should not be able to change any settings on your adapters. Installing any software onto your system through drive by downloads would break the law. So if you did not have to install special software your guess is likely correct. – Gurken Papst Jul 9 '12 at 19:06
up vote 1 down vote accepted

The problem was indeed a virus. This time, it may or may not have installed itself to the boot sector--using an Ubuntu livecd and running fixmbr did not solve the problem. Malware Bytes did not find the virus. Spybot Search & Destroy did not find the virus.

Fortunately, ComboFix successfully removed all traces of the virus. I haven't seen any of the redirects in a month.

share|improve this answer
You could have been more useful and NAMED the "virus".. I would note that I have seen this behaviour from some malware called PenWes that runs as a DNS server – barlop Dec 16 '14 at 9:07

You can check to see if anything is listening on Port 53 your DNS port.

I have seen some malware called PenWes that does this

It appears in Programs and Features under
Spyware & Virus blocker[116]

It can be removed by ComboFix or Add/Remove Programs. Maybe ComboFix is better for removing it.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .