0

I don't know if this is the right place for this question but here it goes...

When I access websites that have Google ads included with a device (pc, tablet, laptop) connected to my LAN, these ads are blocked and replaced with other annoying ads from other ad networks. This happens in all web browsers.

But when instead I use my cellphone as wifi hotspot, the Google ads are shown. Is my local area network infected?

I have run several antiviruses and adware cleaners on my network's pc but nothing found. I also have a CISCO router.

The unwanted ads are coming from 54.204.16.140 and ib.adnxs.com. They are replacing only the Google Ads, not my homepage or anything else.

Improve this question
4
  • 1
    Perhaps your ISP is redirecting ad networks?
    – schroeder ♦
    May 10, 2015 at 2:46
  • @schroeder nope, this wasn't happening until I connected a laptop to my lan (it had viruses and I cleaned it). Now every device on my network shows wrong ads. But when I connect the laptop to my cellphone it shows the google ads.
    – gab06
    May 10, 2015 at 3:00
  • This makes me think that the problem is the network, not the devices.
    – gab06
    May 10, 2015 at 3:09
  • 2
    Check the DNS on your router?
    – schroeder ♦
    May 10, 2015 at 3:37

3 Answers 3

Reset to default
0

It seems to be a DNS issue, as others have said. Whether your router is infected or was reconfigured by malware is a difficult question to answer. I hope this will at least give you a prtial answer. Investigate your DNS settings. First, open a command prompt. In windows, click start menu, type cmd. Right click CMD and select "Run as administrator" if that is an option (you may already be logged in as administrator). In the command prompt window type "ipconfig /all" without the quotes. Write down all of the address where it says DNS Servers. Try the same when you are connected with your cellphone as a hot spot. You may want to Google the first DNS servers with the ones from your hotspot (Goggling while on your hotspot) to see if those DNS's are considered rougue DNS servers. I found some articles that may be similar to your problem. Okay, it's from the FBI, but it's well written. http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf Also, an older article: http://www.pcmag.com/article2/0,2817,2406806,00.asp Also, If you know how to access the administration interface of your router, you can look around for the DNS settings. you can change it to use OpenDNS 208.67.222.222 or 208.67.220.220 or Google DNS 8.8.8.8 or 8.4.4.4 After changing the router settings, Test, Test, Test!!

Improve this answer
4
  • Thanks for the useful links. Checking the DNS from cmd, they are: 192.168.1.1 and 192.168.0.1. Checking from the router configuration, the first one is 192.168.1.1 and the other 2 are empty. When connected using the cellphone as hot spot, the DNS is 192.168.43.1
    – gab06
    May 11, 2015 at 1:16
  • Do a factory reset of your router. Google instructions for your particular router. BTW look it up on your phone, not over WiFi. Just to be safe. Also, read this: aralabs.com/2015/03/25/…
    – Someone.Else
    May 12, 2015 at 3:51
  • I will do it and tell you how it goes.
    – gab06
    May 13, 2015 at 0:11
  • It didn't work. I guess I have malware. Thanks for the help anyways.
    – gab06
    May 22, 2015 at 1:24
0

Check the router DNS settings.

I suspect that the infected laptop changed the DNS settings of your router to use malicious DNS server¹ that return fake entries for pagead2.googlesyndication.com.

The virus should not have been able to do that (it should have required a password they don't have), but sometimes routers have holes that allow changing the settings without a password, or maybe the virus tried several known username/passwords (perhaps there's even a hidden account you don't know of).

¹ Please share the evil IP you find that was the case. I would like to compare it with a similar case.

Improve this answer
1
  • Checking the DNS from cmd, they are: 192.168.1.1 and 192.168.0.1. Checking from the router configuration, the first one is 192.168.1.1 and the other 2 are empty. When using the cellphone as hot spot, the DNS is 192.168.43.1. The unwanted ads are coming from 54.204.16.140 and ib.adnxs.com. I know this because I run myself a website with Google Ads.
    – gab06
    May 11, 2015 at 1:23
-1

An infection of your router is unlikely. ISP's have been known to inject their own ads though. You might want to try changing your router's DNS to use the DNS servers of a third party, such as Google's public DNS or OpenDNS. If you do this and the ads go away, you have isolated the issue. If not, it lies somewhere else.

Improve this answer
1
  • 1
    The OP addresses the ISP DNS issue in the comments.
    – schroeder ♦
    May 10, 2015 at 5:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .