0

I don't know if this is the right place for this question but here it goes...

When I access websites that have Google ads included with a device (pc, tablet, laptop) connected to my LAN, these ads are blocked and replaced with other annoying ads from other ad networks. This happens in all web browsers.

But when instead I use my cellphone as wifi hotspot, the Google ads are shown. Is my local area network infected?

I have run several antiviruses and adware cleaners on my network's pc but nothing found. I also have a CISCO router.

The unwanted ads are coming from 54.204.16.140 and ib.adnxs.com. They are replacing only the Google Ads, not my homepage or anything else.

  • 1
    Perhaps your ISP is redirecting ad networks? – schroeder May 10 '15 at 2:46
  • @schroeder nope, this wasn't happening until I connected a laptop to my lan (it had viruses and I cleaned it). Now every device on my network shows wrong ads. But when I connect the laptop to my cellphone it shows the google ads. – gab06 May 10 '15 at 3:00
  • This makes me think that the problem is the network, not the devices. – gab06 May 10 '15 at 3:09
  • 2
    Check the DNS on your router? – schroeder May 10 '15 at 3:37
0

It seems to be a DNS issue, as others have said. Whether your router is infected or was reconfigured by malware is a difficult question to answer. I hope this will at least give you a prtial answer. Investigate your DNS settings. First, open a command prompt. In windows, click start menu, type cmd. Right click CMD and select "Run as administrator" if that is an option (you may already be logged in as administrator). In the command prompt window type "ipconfig /all" without the quotes. Write down all of the address where it says DNS Servers. Try the same when you are connected with your cellphone as a hot spot. You may want to Google the first DNS servers with the ones from your hotspot (Goggling while on your hotspot) to see if those DNS's are considered rougue DNS servers. I found some articles that may be similar to your problem. Okay, it's from the FBI, but it's well written. http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf Also, an older article: http://www.pcmag.com/article2/0,2817,2406806,00.asp Also, If you know how to access the administration interface of your router, you can look around for the DNS settings. you can change it to use OpenDNS 208.67.222.222 or 208.67.220.220 or Google DNS 8.8.8.8 or 8.4.4.4 After changing the router settings, Test, Test, Test!!

  • Thanks for the useful links. Checking the DNS from cmd, they are: 192.168.1.1 and 192.168.0.1. Checking from the router configuration, the first one is 192.168.1.1 and the other 2 are empty. When connected using the cellphone as hot spot, the DNS is 192.168.43.1 – gab06 May 11 '15 at 1:16
  • Do a factory reset of your router. Google instructions for your particular router. BTW look it up on your phone, not over WiFi. Just to be safe. Also, read this: aralabs.com/2015/03/25/… – Someone.Else May 12 '15 at 3:51
  • I will do it and tell you how it goes. – gab06 May 13 '15 at 0:11
  • It didn't work. I guess I have malware. Thanks for the help anyways. – gab06 May 22 '15 at 1:24
0

Check the router DNS settings.

I suspect that the infected laptop changed the DNS settings of your router to use malicious DNS server¹ that return fake entries for pagead2.googlesyndication.com.

The virus should not have been able to do that (it should have required a password they don't have), but sometimes routers have holes that allow changing the settings without a password, or maybe the virus tried several known username/passwords (perhaps there's even a hidden account you don't know of).

¹ Please share the evil IP you find that was the case. I would like to compare it with a similar case.

  • Checking the DNS from cmd, they are: 192.168.1.1 and 192.168.0.1. Checking from the router configuration, the first one is 192.168.1.1 and the other 2 are empty. When using the cellphone as hot spot, the DNS is 192.168.43.1. The unwanted ads are coming from 54.204.16.140 and ib.adnxs.com. I know this because I run myself a website with Google Ads. – gab06 May 11 '15 at 1:23
-1

An infection of your router is unlikely. ISP's have been known to inject their own ads though. You might want to try changing your router's DNS to use the DNS servers of a third party, such as Google's public DNS or OpenDNS. If you do this and the ads go away, you have isolated the issue. If not, it lies somewhere else.

  • 1
    The OP addresses the ISP DNS issue in the comments. – schroeder May 10 '15 at 5:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.