3

It is interrupting most pages from loading on the devices in my network. Here are the steps so far I have taken:

  1. Ran ipconfig/flushdns command in cmd.

  2. Removed irrelevant IP addresses in hosts file.

Important thing is that my router's DNS address is always changed to some random site.I cleared it around 5-6 times. Still I think it will be changed. Scanned router with ESET Smart Security 10. Also scanned systems with Kaspersky and ESET. What I found strange is that the URL still remains original even after appearence of that error. I reinstalled Google Chrome. But, it is still appearing.

My router is a DLINK DIR 600 M.

Screenshot of website replaced by malicsious site.

  • In addition to that yesterday I have inspected that purple button. It is when clicked, taking to a link i.e "live.com/install_plugin.exe" . I came to know that site is related to microsoft mail. I also tried to execute the .exe file which is downloaded when I clicked the button. It is opening a cmd cosole with address in system as "c:\sysdata\dnschangerconsole". I searched it system and it contains two exe file and config file. Whenever I open a site, the page just appears in the same way as the pic provided. No url change is displayed. – Krishna Vamsi Vedula Mar 22 '17 at 6:01
1

You are infected with malware. Try using some kind of malware removal software. If it doesn't work, save your data and perform a clean O.S. install.

You can use a lot of software, but as a recommendation:

Malwarebytes has its free version which has no real time protection to avoid being infected, but free version is able to remove malware once infected like in your case. You can activate a 30 day premium trial if you want real time protection.

Good luck.

| improve this answer | |
1

Use the latest DIR-600 firmware, and change admin/wifi passwords. Before flashing new firmware, please backup the old config and post it online and give us a link.

Remember to set DNS/IP manually before downloading new firmware for your network card, google DNS1 8.8.8.8 , DNS2 8.8.4.4 .

Here's a break-in procedure for the DIR-600: http://www.s3cur1ty.de/m1adv2013-003

| improve this answer | |
0

Recommend running Tron and going from there.

Tron is a script that fights for the user. It's a multi-stage bootable system cleaner. I find running it on clean Windows installs yields great performance afterwards, and works wonders for badly infected systems. It runs most of the tools mentioned in this page, plus a few others.

You will also want to use another router - This would highly recommend Mikrotik (hEX S) as a replacement, as it offers way more control and is very configurable, especially with regards to DNS. Watching the logs in real time also helps you get an idea of what's going on network-wide, assuming your router has been infected, even a clean-up with Tron might work initially, but will lead to re-infection if it's indeed the router that is hacked.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.