I faced problem where DNS IP in Network card properties was automatically changing to 85.*.*.* ( Ukrain IP)
It is a rootkit problem. It creates superhidden file
%systemroot%\system32\drivers\msqpdxpaxloeqh.sys
It also creates entry at
KEY=HKLM\Software|msqpdx\injector
Name= services.exe Data=msqpdxdfswfh35g2.dll