Just found out that the primary & secondary DNS servers have been changed to
I had the following setup in place.
- MAC filtering and WPA2 for WiFi.
- Administrator password was left at default. (Suspect this was the loophole exploited. Clickjacking I bet?)
- NAT & IPv4
- All the Services were turned off for WAN side, including ICMP.
- Only HTTP interface was turned-on for LAN side.
- Two other windows laptops connect to the modem via WiFi. Used by old parents and kids. Probably the easiest targets. Scanned for virus/trojan. Nothing found.
Would be helpful to know the steps I should take to lock down the network from being compromised again. Also, what kind of data leak could have took place, besides the DNS names ? Are these IPs known to anyone ?
Modem : DSL-2750U
Firmware version : IN_1.10