Problem: DHCP Server provided IP & DNS properly to clients, but later only DNS IP gets changing to someother IP
1. Use a network Analyzer, DHCPfind tool,Network Analyzer Tool (WIRESHARK) & find out, is there any other DHCP servers exist in Network with that DNS IP.
2. Else it will be virus,
3. Verify the logs in DHCP Server too ( C:\WINDOWS\SYSTEM32\DHCP)