This was my original post, July, 2023:
"I've read the previous descriptions of "Trojan.DNSChanger", and it appears that's what's happening to me. I have a brand new, 3 days-out-of-the-box laptop, and it's already displaying exactly the same symptoms as every other PC & laptop I own...My IPAddress is being changed by some kind of malware; (and as an interesting fact, it ALWAYS changes it to an IPAddress on an Amazon Data Server). I've tried sitting here keying into Terminal:Admin, "ipconfig /release", "ipconfig /renew" and my ipaddress keeps coming up pointing to the same 5 or 6 addresses that are all over the U.S. but not my state, and not my network-provider. If I occasionally get one I know is valid, in the 2-3 seconds it takes me to turn on Norton VPN and try to lock it, it has already been changed by the Trojan.
I've downloaded and run MalwareBytes, and it found some PUP-ware, but nothing like the DNSChanger, or any other RootKit software. What do I have to do to get rid of this and block it from being reinstalled?"
To be clear I've been fighting this IPAddress/Change problem for over 5-6 years... I finally stumbled on to the solution, at least for MY specific problem!!!
But I finally figured out what was hijacking my system(S)…BOTH of them, desktop (Win10), and laptop (Win11)!!! I kept digging and digging into various Network and Internet settings. And this morning I read a random article about “Why you would want to change your DNS and Backup-DNS settings”, and one of the reasons was to get around malware hijacking your DHCP settings… I dug some more on my laptop Settings and I found that something had created a Rogue “(Logical) Adapter-2”. It was masking its settings, and there was no way to delete it, and no way to create a REAL “(Logical) Adapter-1”… But the one giveaway was that a VPN on Adapter-2 was pointed at the German Software Company that makes the “TeamViewer” software!!! I went to Control Panel/Programs & Features and deleted the TeamViewer application. Rebooted my system and when it came up ALL of the blocked URLs & websites were back! AND, the “whatismyip” website reported that my IPAddress was “97.x.x.x”; “Highland Park, CO”; “CenturyLink”!!!!!!! (That's the first time my IPAddress has pointed to a CenturyLink server in over 5 years!)
I went in to my desktop machine, deleted the TeamViewer app and rebooted the machine, and the “whatismyip” website reported that my IPAddress was “97.x.x.x”; “Highland Park, CO”; “CenturyLink”!!!!!!!!!!