The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by an ad bot that redirects me to ads websites whenever I click on any link. I then installed Malwarebytes, Adware Cleaner and other AV softwares to clean up my PCs but not any of them have detected anything. I thought that this maybe some kind of router hacking so I made a hard reset to my router and re-configured it with my ISP, then the problem solved on all of my PCs. However, it remained on my phone. I then made a reset to factory settings, formatted everything, all apps deleted but the problem still exists and I'm being redirected to ads websites, I almost tried every AV app on the playstore but they didn't catch anything. What should I do in this situation? I don't know any other way to solve this problem. I have to mention also that this bot works only on my phone when I'm connected to my router and it doesn't work when I switch to the mobile data. On the other hand, if it is still a hacking on the router, it should also affect the other PCs. Any suggestions guys? I really appreciate any idea.
3 Answers
What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers. You can confirm this by disabling the proxy server. If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure.
You can reset the DNS server settings to what they should be (your ISP can tell you what they should be, your router may be able to get them automatically or you can use a third-party service like Google or OpenDNS) to fix the initial problem for the local network.
Then you also need to prevent the attack from happening again. Measures to do that include:-
- performing a factory reset to clear any settings left by the attackers
- installing the latest router firmware
- using a strong password on the configuration interface
- limit access to the configuration interface to appropriate places (wired, local connections, not the internet)
- log out of the configuration interface after use (and do not tick 'save password' on your browser when configuring the router)
- changing the IP addresses used and supplied by the router (for example change from 192.168.1.1 to 192.168.123.1)
The location of settings varies by model and if you're not sure how to check these settings then check with the manufacturer of the router, your ISP's helpdesk or bring in a professional. Some of those options may not be free of charge but will be worth it.
I agree with everything that the first person to answer your question has said -- this is likely a router DNS hack, UNLESS there is persistent malware on some other endpoint (say, your child's computer) within your local LAN (the one whose IP addresses start with "192.168" etc. etc.) that is attacking the rest of your local infrastructure faster than you can clean it.
Don't forget -- the people who do this kind of thing are ruthless criminals, the lowest of the low. They are stealing the use of your infrastructure and will continue stealing it until you forcibly eject them. Unfortunately, this is the situation on the Internet today -- the minute you plug in to it, you are exposing yourself to every miscreant, literally around the world, who wants to steal from you.
And this gets to the only other thing I have to add, to the previous poster's comments : before you do ANYTHING with your router, your ADSL / cable modem, your PC, etc. -- UNPLUG COMPLETELY FROM THE INTERNET. You need to be cut off physically from ANY data path that the attacker could use to re-compromise your local LAN, while you are trying to "sanitize" it.
Some of these cyber-criminals have botnets with a "heartbeat" function -- if they see a node (in this case, "your router") momentarily drop off the botnet, they conclude "the legitimate owner is trying to get rid of my malware -- can't allow THAT, now can we?) and it triggers an auto-attack script to bombard your infrastructure (e.g. your public IP address) with various exploits until one of them gets through and you're back to Square One.
So the rule is simple : DISCONNECT FROM THE INTERNET, clean everything up and then only reconnect devices, one by one, that you are sure have been completely cleaned and "hardened", to stop these sleazebags from trying to again get a toe-hold on your LAN... because, at the end of the day, it IS "your" LAN... not, "theirs".
Good luck!
-
A factory reset on most routers will usually isolate the LAN from the outside. Although disconnecting would ensure it. Commented Aug 25, 2014 at 15:34
Id just get a dynamic IP or buy a new router and get a new phone or buy a burner phone copy all of the files on your current one onto the new phone and see if it persists.
