Q: onclickads - malware or virus?

omijan7 wrote:

 

My laptop and desktop both list: 192.168.1.1

That's your wireless router. You'll need to check and see what DNS settings it's using.

Aha! I think we have a winner! Looks like two of you had the same Serverel.net/com DNS servers.

Now the question is, how did it get that way? Are these settings specific to your computer, or inherited from your wireless router? If they're in the wireless router, then it must have been hacked and will need to be reset... but then that begs the question of why your other devices were working fine.

If none of your other devices have those settings, then how did your computer get set that way?

Actually, I'll bet the phony Flash update was a symptom, not a cause. There are a lot of known router hacks that cause fake Flash update pages to appear when trying to visit common pages (Google, Yahoo, Facebook, etc). And there doesn't appear to be anything malicious on your machine.

In any case, I'm glad you seem to have gotten it fixed!

I encountered the same exact issue. In my instance all devices were experiencing the same problem. Upon noticing these DNS entries I attempted to login to my router and noticed its password had been reset/changed and so I performed a permanent reset on the device.

One thing to note: I was using a DDNS to expose my router login page to the outside world and perhaps my password was hacked in this way, who knows. I have a cisco e4200 fwiw.

Joe

Want to chime in - I was having the same popups issue appear around the same time this thread started. Noticed it was only when devices were connected to my home network, checked the DNS settings on my router, googled them, (199.182.166.168 and 199.182.166.169) and found this page. I've changed them back and seems to be all good, but the question on my mind is how the DNS settings changed in the first place? There is a password on my router (Cisco Linksys E1500), and it was not changed. The router admin page is accessible from the Internet, and while improbable, it's plausible that the password may have been guessed. Would love to have more people chime in to see similarities. Already seeing a few between me and joe.

Your router has been hacked. It is not necessary to know or guess the admin password. See:

https://tools.cisco.com/security/center/viewAlert.x?alertId=29291

Wow - thanks for that. Didn't think to look that up. There are several vulnerabilities in the E1500 that Cisco will never fix, by the looks of it. I just turned off remote access, and will look into installing something like DD-WRT on it.

Good plan.

Thank you Thomas and Noel,

Here's the vulnerability report for the E4200: http://tools.cisco.com/security/center/viewAlert.x?alertId=32943

Vulnerable products for this exploit : Linksys EA2700, EA3500, E4200, EA4500

Joe

I'm not sure it was the exploit.  My router is the WNDR3700v3.  I don't see any exploits for that.  The commonality here is that we all had the remote admin feature turned on and open to the outside.  Mine even had a link to it from a webpage seved on port 80 of one of the machines in my network.

A few days ago I also found that my router's DNS ip addresses were set to 199.182.166.168 and 199.182.166.169. I have a Linksys E1000. 

I had remote admin turned on for testing but I've since turned it off again.  But a hacker doesn't need remote admin or the router password to hack some routers.  It can be a malicious browser script run inadvertently by a home user behind the router. Such a script could use a Cross-site scripting (CSS) attack to change certain settings in the router.  I notice that Cisco has released updated firmware for the E1000 that "addresses several security issues" though they don't go into detail.  So I have disabled remote admin and upgraded the firmware.  Hopefully that's the end of that.

But still, who owns 199.182.166.168 and 199.182.166.169??  Serverel is only a colocation facility.  The owner of those IPs would be a client of Serverel.  If thousands of routers have been compromised recently, this could be a very serious problem.  I submitted a complaint to the FBI.  We'll see if anyone reads it.

Port forwarding isn't really the issue... that exposes your server to possible attack, but not your router. The issue is that your router has security vulnerabilities that allow it to be attacked. Some botnet is probably finding your router, detecting that it's vulnerable and hacking it.

You could buy a different router, or you could install the DD-WRT router firmware:

http://www.dd-wrt.com/site/index

This would give you more secure firmware.