We had the same problem in our house using a Linksys E3000 router.
It happened to us about a month ago and I changed the DNS on the router to the openDNS ones, changed my password on the router also to a super long high security one.
Then somehow, the DNS on the router got changed again to these 'spammy' ones that feed up all sorts of dumb ad link pages and nasty **** that the kids don't need to see.
Our IP is Comcast, but the router is not theirs and the router will only grab up Comcast's DNS numbers when it first boots or gets a new IP from them.
On my own Mac workstation, i had changed the DNS to be openDNS.org so I didn't notice when the router got hacked again.
I then did more research and found that there was a newer Cisco firmware version for this E3000 router, which might solve the problem. I upgraded and am waiting to see now.
They must have found a way into the router through a 'backdoor' since it would be next to impossible to guess my pw and i don't use it anywhere else.
I think I'm going to upgrade to a newer router and then install Tomato firmware to run and manage the thing. There are much better diagnostics in Tomato and since i'm running a big house with multiple access points, it would help to see what traffic is going/coming from where.
Quick fix, even if you don't have direct access to the router (your neighbor's) is to manually change your own DNS setting in the Network control panel. See the field below for where you should insert the two numbers, but ignore my other settings. I have a fixed IP (.99) for my workstation.
It makes me VERY nervous to think someone has control of my router, since there are all sorts of crazy things that one could re-direct and control, like getting a list of all the active devices on the network and maybe even their type (PC, Mac, printer, thermostat, house control, IP cameras,etc) and then know which ports are open or even redirect ports to the devices they want to try and hack into...
I hope installing the new firmware deleted any 'trojan' and 'backdoor' that might have been there, then rebooting.
Also remote access was enabled before with my super high sec. pw, on an alternate port, so I doubt that could have been the way in.. nevertheless, i've turned that off for now...
