I don't know if this is the correct forum where to ask, but I didn't find anything more appropriate.
I have a TP-Link router model TD-W8951ND, and three months ago I noticed that the network was getting slower each day. I then looked at the router settings, after various reboots and i noticed it had been changed, to a service that resolves to "GhostNet GmbH".
After several PC restores, cache wipes and other sort of things, that think kept occurring. I then looked in a forum that was the ROM-0 problem, in fact every router with the ZynOS operating system, have the top page /rom-0 that can be accessed without authentication and contains the router full configuration. So, the hackers were able to get my router password from that file, and change the DNS through Telnet.
So I blocked incoming connections over telnet and HTTP from remote, changed admin password and the problem was gone for a month. Now it occurred once again but this time the DNS resolves to Edis GmbH... Any help?