0

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I reinstalled my Windows with factory settings but still "ad.adsmatte" keeps coming. I don't know what to do. Is my router infected? I checked the DNS service but it was set to obtain IP address automatically.

Please help, I have been stuck with this problem for 2 days and also have tried Google search and followed the instructions mentioned on various websites.

I'm using Google Chrome as Browser and Windows 7 as OS.

Edits: If my router is infected how come my android device which uses same router to access internet runs fine?

0

7 Answers 7

0

If your router is affected and you're facing different issues on your devices (android has no ads, computer does) may check/change your DNS settings on both devices and on the rooter.

I think you android phone uses a different DNS server as your PC. Your PC propably uses your Router as DNS Server (e.g. 196.168.1.1) and your android uses a 3rd party DNS like Google (8.8.8.8, 8.8.4.4) OpenDNS,. For this behaviour check: https://superuser.com/questions/767172/dns-server-at-router-level-vs-computer-level

To clean up your router may have a look at: Can I have a virus/adware in my router?

Then you also need to prevent the attack from happening again. Measures to do that include:

  • performing a factory reset to clear any settings left by the attackers
  • installing the latest router firmware
  • using a strong password on the configuration interface
  • limit access to the configuration interface to appropriate places (wired, local connections, not the internet)
  • log out of the configuration interface after use (and do not tick 'save password' on your browser when configuring the router)
  • changing the IP addresses used and supplied by the router (for example change from 192.168.1.1 to 192.168.123.1)

posted by @James Snell

1

I had ads and redirects via ads.matte.com on many devices on the network including android phones, PC's and IPads. I found out that going through a VPN service fixed the problem completely but didn't want to run a VPN service on all devices.

The solution for me was similar to some other contributors but very simple to do. All devices used DHCP from the main router. I checked the DNS settings within the Internet settings (not DNS within DHCP settings, this should be the same address as your main router gatweway address, commonly 192.168.0.1 etc.), and usually the Internet DNS servers would be provided by your ISP or you may be using google 8.8.8.8 or another DNS service.

In my case I didn't recognise the DNS server number so I looked it up and it turns out to be some Eastern Block country with the website friendhosting.net using IP 185.82.216.99 . I changed the DNS server to google 8.8.8.8 and cleared the cache and cookies from the browser in my PC and the problem was fixed. I cleared the cache and cookies an a couple more devices and this immediately fixed the problem on these devices too.

On one device I deliberately didn't clear the cache to see what happens and I went straight back to rubbish served by adsmatte.com . I then cleared the cache and cookies on this device and the problem was fixed immediately. The same fix was applied for the remaining devices and the network is back to normal.

One point to note - I logged onto a different network whilst having this problem and the problem remained, which made be think the problems was mainly due to a hijacked browser. I think what happened here was that the cache and/or cookies were still causing the problem and had I thought to clear them once connected to this other network then the problem would have probably been fixed too, providing their router had not been hijacked too.

So how did the router address get changed? The problem network is another family members so I've no idea what they may have done or downloaded but it's fixed for them now. As a bit of added protection I changed the DNS to OpenDNS (208.67.222.222 and 208.67.220.220) and it works really well.

0
0

I ran into this issue not too long ago. If you have done a clean OS install then it is likely that your Chrome settings have been tampered with, infected, auto-backed up, and restored once you log into Chrome again after the clean install.

You can try and reset your Chrome settings. It actually took me hitting this more than once and manually inspecting my settings.

As an aside: I've noticed that using other branches of Chrome (e.g. Canary) tend to not get tampered with as the application is not that "standard" Chrome that most malware looks for.

1
  • After clean OS install I am using firefox which I was not using before. Still That "ad.adsmatte.com" keeps showing on every click.
    – Totoro
    May 20, 2015 at 7:50
0

This does not appear to be an OS/browser related issue. I would recommend you to read this http://www.quora.com/How-do-I-stop-AdsMatte-spam-popups-and-ads

What it says:

I believe all your default gateways is "192.168.1.1" Open this from your PC. If you can't open it, the the solution below must work:

I believe you should know about it first(skip to solution if you want :P ): AdsMatte is a adware(maybe even malware) that infects one router. It also happened to me just today. Someone from my home must have downloaded it. Googling about it I found out that it has also affected PC's of some people as well as android and windows phones. It didn't corrupt my PC so I believe a proper antivirus can prevent its spreading in computer. But that was not the case for my android, so once it has affected a router, an antivirus can't prevent it from spreading over Wifi. This type of adware generally comes what one installs insecure app (or maybe even download bad files). I believe antivirus can help prevent it( I use avast for mobile) and would everyone to get an antivirus installed in all the devices that use net.

THE GRAND SOLUTION( It worked for me. May or may not work for you ):

You must have your PPPoE username for it. It is your username registered at service provider( mine is ra1360******). It is NOT

ADMIN. If you don't have it, obtain it by calling your service provider. You must know how to set up your modem, otherwise, Do not go further without it. Call someone from service provider for help(most are inexperienced, so believe me don't try to tell them issue. They will tell you to turn modem on and off. Just ask someone to come and reset your modem). Hard reset your modem. It is done by putting a pin to press a button in a small hole on the back side of modem and holding the pin for 10 to 15 seconds, depends on modem. Disable wireless connection just after setting up your modem and install an antivirus in all the devices by downloading .apk on your pc and sharing it with everyone. Reset cache and cookies of every browser and reboot your device.

Basically it is an attack on/via your router. You should hard reset it. A lot of computers on my intranet got affected. I got rid of it that way.

Similar one here https://askubuntu.com/a/626156/333421

2
  • @C.S. If my router is infected then how come my android device which I connect to router runs fine?
    – Totoro
    May 21, 2015 at 6:07
  • 1
    @Totoro Maybe the configured DNS is not the Same (Computer uses router as DNS, Android has a different DNS configured). Check my answer for details
    – Danny.
    May 21, 2015 at 6:48
0

I have been suffering from this virus for last seven days, but in my android tablet. I have formatted my tablet three times in three days, but problem reoccurs just after installing the browser.

It is correct that it alters your DNS server address.

I have read a post somewhere in the xda forums that gave me hint about this: go to wifi settings and find the DNS server address (this was bad in my case). I changed the DHCP settings to a static IP and the problem was gone. Now my browser runs smoothly.

I have changed both my android phone and tablet IPs from DHCP to static, both were suffering from pop ups and now both run perfectly.

0

My website was also infected with adsmatte problem. when user opened it in mobile device it just opened a bunch of spam ads. and when on PC, it opened popups. I researched a lot and finally tried a suggestion i read on one of the forums. Check every SCRIPT by disabling it.

I did that and found the real culprit for my website was 'Sharethis.com' widget. I disabled it and problem was gone. I re-cheked by enabling it again and the problem came up again.

0

I had the AdsMatte issue as mentioned by lot of other users. I tried reinstalling OS/Browsers, tried multiple PC with different OS (including Mac) and still it would magically come back.

I realised that the problem has to be outside User Machine. I wanted to long on to my router but 192.168.1.1 would always timeout. It was very frustrating. I was sure the DNS is hijacked and router is pointing to its own server and happily trying to allow traffic when it wants, when it wants would show whatever it wants. The Primary DNS my router was pointing to 5.152.219.51 and secondary DNS was 5.152.219.50.

It was high time, I bought another new Router. First thing changed the Router Admin password before setting it up to my ISP (Internet service provider). Post that without changing anything on the PCs/Mac the issue has gone.

The DNS my new router is pointing is 125.22.xx.xx.

ALWAYS CHANGE THE MODEM/ROUTER PASSWORD as soon as you buy it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .