rdsrv keeps coming back after i reset my modem/router

Question

Level 1

0 points

rdsrv keeps coming back after i reset my modem/router

rdsrv redirect seems to have infected my network. i am using an imac, macbook pro (both yosemite, updated) and an iphone 4 in my wifi.

while surfing the internet (not all sites, google, apple and some other work normal) there is no mouseover on links

The Bar at the Bottom of the Browser where the Link Adresses are shown says "rdsrv.com/newbidder/click.php?....something.

and when i click wherever on the site a new Tab opens with random Ads.

I close them, go back to the Website i was on, then the Links work normal.

This happens in Safari, Firefox and Chrome on all Computers within the WiFi and also on iPhone.

i´m not shure what led to the infection.

seems like it is changing dns settings on the modem (sitecom dc-229)

when i reset the modem to default, it goes away for some time, but the next day it´s back..

Did this 3 or 4 times now, and do not know what to do besides buying a new Modem

I also updated the Router (TP-Link TL-WDR 3600) and reset to default.

Also changed the Passwords..

It is happening also when i plug in a LAN cable to the Modem so it should be the Modem?

Why does it keep coming back and how can i solve this?

iMac, OS X Yosemite (10.10.3)

Posted on Apr 10, 2015 10:13 AM

Reply

Answer 1

Linc Davis

Level 10

209,541 points

Apr 10, 2015 2:17 PM in response to Crictor

Your router is repeatedly being hacked to direct DNS queries to a malicious server.

Repeat the initial setup process. Make sure the router does not allow remote setup from the Internet (WAN port), if it has that feature—most do. The DNS servers should be set automatically by your ISP. If you still have trouble with those servers selected, contact your ISP.

Check the router manufacturer's website for a firmware update.

If you have a wireless network, it must be secured with WPA 2 encryption. The passwords for the network and the router must each be a string of at least 10 random upper- and lower-case letters and digits, and they should be different. Any password that you can remember is weak.

If the router continues to be hacked, get rid of it.

Reply