DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

My 2860ac got infected

  • tamerhabib
  • Topic Author
  • User is blocked
  • User is blocked
More
08 Dec 2015 06:14 #1 by tamerhabib
My 2860ac got infected was created by tamerhabib
I am not professional but I was facing serious problem when I visit any site I always redirected to different sites not related to me, I thought it was a problem in my PC but after I formatted my system the problem remains, when I unplugged my draytek and used Asus RT-ac3200 the problem gone, I am afraid that my router got infected with adware or virus. How I can hard reset my router because normal reset didn't solve the problem, I need help please

Please Log in or Create an account to join the conversation.

More
08 Dec 2015 07:15 #2 by admin
Replied by admin on topic Re: My 2860ac got infected
Your router cannot get infected; it has no facility to load additional coding/macros.



Forum Administrator

Please Log in or Create an account to join the conversation.

  • tamerhabib
  • Topic Author
  • User is blocked
  • User is blocked
More
08 Dec 2015 08:01 #3 by tamerhabib
Replied by tamerhabib on topic Re: My 2860ac got infected
Ok what is the explanation of that ? Does draytek force another DNS server ?

Please Log in or Create an account to join the conversation.

More
08 Dec 2015 12:02 #4 by admin
Replied by admin on topic Re: My 2860ac got infected
To get 'infected' an entity has to have a facility to hold and/or execute 3rd party
code or macros. It's nothing to do with DNS... if you think your DNS server
addresses are set incorrectly, that's not an 'infection' (but it could be a problem).



Forum Administrator

Please Log in or Create an account to join the conversation.

  • cocospm
  • User
  • User
More
08 Dec 2015 15:50 #5 by cocospm
Replied by cocospm on topic Re: My 2860ac got infected
Hi tamerhabib. Rather than play unhelpful word games with you, I'll try to actually help. Because you don't have your 2860 connected, and you don't know what DNS servers it was using, it isn't possible at the moment to conclude with any degree of certainty what happened. It is possible, however, that one or more of the devices on your network may have been infected by DNSChanger, or some similar infection. These infections work by reconfiguring the DNS servers on a router so that all DNS requests go to the attacker's own malicious servers. This enables them to easily redirect web pages or inject advertising into web pages served back to you.

While the malware will itself reside on one of your devices, it leverages your router to accomplish its work. It can reconfigure your router by determining your router's admin username and password, and this generally requires that you leave the vendor's default username and password (if any) in place. Lots of users actually do this. Make sure, therefore, that you do change your router's password to something strong.

Also, your web browser caches web page content you have recently downloaded (such as when any DNS hijacking may have been in place). I would advise you, therefore, to completely empty your browser's cache on all devices connected to your router.

Please Log in or Create an account to join the conversation.

More
08 Dec 2015 17:03 #6 by admin
Replied by admin on topic Re: My 2860ac got infected
Bit rude, cocospm :-) I'm not sure assumptions necessarily have anything to do with his issue. He said he's not very technical and English
is not his first language so he can't easily describe the symptom/problem. He mentioned DNS (though it's unclear how he
came up with that) so, like I said it could be the problem, but it's most certainly important to understand that the router cannot get 'infected' - that was an important principle to make clear, it's not word games, and therefore he should be looking at something else that is using the router (other than checking the router's DNS settings). If you were to believe that your router can be 'infected' you'd try wiping or replacing it and expect the problem to go away.

It's quite a stretch to guess that he has a keylogger/Trojan sniffing his username, or using the defaults and changing the DNS servers on the router, but if that is suspected one can visit https://www.dnsleaktest.com/ which will tell you which DNS server is in use. If the DNS server is something that's not your ISP, not Google and not something you expect, then something's amiss, but could be PC interception, not the router. It is, however, possible for people/actors/systems to change your router's DNS if you've enabled remote access and left a default/insecure password (very bad!).



Forum Administrator

Please Log in or Create an account to join the conversation.