3

This is my first question in security, so let me know if something about the question should be fixed.

Some background information: My Windows 10 laptop was starting to get realy, realy slow when browsing the internet (Chrome lagged alot when fetching simple pages like www.google.com). However i could still play rather demanding games without too much trouble. A week ago i got a call from my internet provider telling me a unit was sending spam-emails from the IP of my appartement.

To try to fix this, i ran a full AVG-scan on both my Windows 10 units (nothing was found). I also had a raspberry pi, open for SSH-Connections with default username and password (very bad practise, i know) which i turned off and disconnected.

My guess was that is was the PI that was responsible for the spam-emails. But since my main laptop was much slower than it should be, i did a fresh install of Windows 10 today, through a bootable USB.

Now to my problem: The first thing i did, on the new Windows 10, was to open edge and type www.google.com, but i got no response, just a blank page, tried closing Edge and redo, same issue. Then i tried Internet Explorer and i typed in www.google.se, and i somehow ended up at a "There are hot womens in your neighbourhood"-site (the domain ended in rsc.cdn77.org).

My question: What can be the reason i was redirected to that page on a freshly installed Windows 10 and should i still be worried? Can my router be infected (its a standard router from my internet provider on which i could not lockate the DNS on)? Can another unit on my WiFi be infected and cause this (the only other units connected was two Android phones, a TiVo and a couple of chromecasts according too me and according too the status page on my router)?

  • Did you get the software from the bootable USB from somewhere reliable (such as Microsoft)? If not, I would suspect that the new install of Windows came with viruses pre-loaded. – Simon B Sep 9 '17 at 22:12
  • It came from Microsoft. – Cleared Sep 10 '17 at 5:31
1

It sounds like your router has been infected by a dns hijacking malware.

  • Can that be fixed by simply resetting the router (i.e. pressing the reset button at the back)? Or can it be infected at a deeper level? – Cleared Sep 10 '17 at 7:09
  • 2
    It depends on the malware and the router but you might want to give it a try – Stephane Sep 10 '17 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.