Author Topic: can the router settings be changed by virus? If it is secured by ISP (Read 48959 times)

jraju · « **Reply #25 on:** January 17, 2016, 05:37:21 pm »

Hi, Samson,
Thanks . But i could not access the default gateway. I am getting user pw screen. If i enter, then it goes and inform that the ROM o page is protected. I do not know, how the thing came to my router.
They will not exchange the modem if it is working. Moreover, i was thinking of upgrading the firmware, but i could not log on to the page itself.
If i reset the modem or router, i think both are one and same, then it has to be reconfigured with the ISP again. Is it easy to configure after resetting. Because, i once reset, but i could not get internet access, even though all lines are clear,but the router settings changed.

Samson · « **Reply #26 on:** January 17, 2016, 05:55:28 pm »

Quote from: jraju on January 17, 2016, 05:37:21 pm

I am getting user pw screen. If i enter, then it goes and inform that the ROM o page is protected.

Both accessing via Android and Windows?

Quote from: jraju on January 17, 2016, 05:37:21 pm

They will not exchange the modem if it is working.

It is n't working (properly) is it.

jraju · « **Reply #27 on:** January 17, 2016, 06:14:03 pm »

Hi, Samson
Wifi connection by android , and bb thro computer, with the same modem.
Regarding working of modem, it is perfect hardware wise, but the page of modem, reuter is having some problem. If i reset, the modem often, then i need to reconfigure again and again. If only i know how to reconfigure the modem pages, in the default gateway. I could make some changes.
The error i get is
Protected Object
This object on the RomPager server is protected
So, reset is necessary atleast this time.

Samson · « **Reply #28 on:** January 17, 2016, 06:30:24 pm »

Have you ever changed the login details?

If not, try Username : admin, Password : admin
From what I have found these are the defaults.

If you do a factory reset, then you will need to enter your ISP settings, WiFi settings etc, do you have these?

jraju · « **Reply #29 on:** January 17, 2016, 06:35:43 pm »

Hi, that is the problem why i have not resorted to reset again.

Samson · « **Reply #30 on:** January 17, 2016, 07:01:06 pm »

You say "again"..so does that mean that you do have all the ISP details at hand to re enter? If you do and decide to bite the bullet and reset it, then follow Shane's 30/30/30 guide

http://www.pcwintech.com/how-do-hard-reset-aka-303030-reset-your-router

jraju · « **Reply #31 on:** January 17, 2016, 07:09:08 pm »

The problem is when i reset, the router page turns to default. I have to reconfigure those settings to get my access back. Eventhough it is minimum, they are not giving the details. Without knowing how to go about it, i find approaching the configurer, techman often a kind of making irritation. This problem may be experienced by so many in their routers, but they would not say about how to keep your router page safe. I mean the settings secured. Now, how can i go to the gateway. That is the first problem. I could not log on to gateway. I receive the error message i posted a while ago. Thanks for all your tips.

Samson · « **Reply #32 on:** January 18, 2016, 12:58:15 am »

J, We need to recap here.....

Have you reset the router before?

Do you have the ISP settings to input after a reset?

Have you tried the Username: admin
Password: admin

Failing the above, then contacting your ISP, like it or not is probably your only recourse to a successful outcome.

jraju · « **Reply #33 on:** January 18, 2016, 03:39:21 am »

Hi, Samson
today i brought the modem to the ISP configurer. He told that there might be something fishy about the whole thing. I asked him to check. he tried by getting my tele line , and started accessing the gateway. He asked me whether i reset anything. I said, i had not done after configuration recently. He tried and he also had the same error. It does not let past the password screen, saying object is protected.
Believe me or not, he tried successful reset and factory reset . He tested some ping test, and lastly he could get the internet light . I was getting all the lights including connection, but could not access gateway.
I already told him that every time i contacted the help desk, they will give a sort of numbers to reestablish the connection. I said that this had been annoying , as always one would not know, when my internet connection will go, and to get another points from help desk. He says that there is no setting of port 80 in the modem settings.He aslo ruled out the possibility of updating firmware. He says that i may loose all acess if i do so, without analyisng the whole thing.
At last after four trials i could get back my internet access. He advised me to use the internet and disable the wiifi in the settings , if at all to get rid of this problem.
Does the usage of android phone injected the so called Rom 0 or the reverse is yet to be analysed.
he says frequent configuration may completely make the modem unusable.
the modem i bought when i got internet connection, manufactured by the company itself lasts till today without any problem. The terracom modem has this problem.
Now , how to get riod of this so called hidden page virus. Is there any safety scanner without any side effects like internet connectivity loss?
His experience in going to cmd and typing some commands, checking with his modem on the settings applied , his technical expertise were spent on my modem for nearly one hour to get the kind of response .
I tried one scanncer, but it could not first of all recognize the wifi connection, as it is included in the internet modem as one. So whenever one switches , the wifi comes alive. I did not share the password of my wifi.

Samson · « **Reply #34 on:** January 18, 2016, 03:52:05 am »

J, I don't know what you mean by "Hidden page virus".

Again the Avast warning was NOT that you are infected, but that the router is vulnerable to attack, what was the tech's response to that?

Unless you aare looking to get another router, you may just have to live with what you have got

jraju · « **Reply #35 on:** January 18, 2016, 04:23:13 am »

Hi, I mean router virus rom 0.
To live with what one has is content.
To aspire for what to have is success.
I also know in a way that avast is pushing you to buy their trial product . I am thinking of telling my son to uninstall avast from his mobile and to get some other protection which is not pushing you something.
Avast of late, is pushing so many things, like grime fighter,vpn etc.
I wish to inform all the readers that once you choose any trial, it will not only give any result on solved matter but would push you to buy their products. If you do that, your wifi access may get total protection, but you could not have any idea , what it is doing in the background or anyside effects.
I had to approach the configurer to break this protection, and to be relieved. Mere reset does not do any good. I also read some threads in the forums about the so called secureline. Please try instead products from pcwintools, which will give you protection with no side effects like no access, or reset errors. Today only i had seen some tools in that site. I think , i will try those

Samson · « **Reply #36 on:** January 18, 2016, 04:34:56 am »

Is the Teracom router supplied by your ISP or did you buy it yourself?

Was the tech guy from your ISP (BSNL?) or from Teracom?

I have never heard of Teracom before. I am not a fan of ISP routers (they tend to lock them down). I prefer to use a reputable third party router, in my case I have always found Netgear to be reliable, well supported and reasonably priced.

Have you tried looking for BSNL/ Teracom forums in India, I cannot think that you are alone in facing this situation and others may have a solution.

jraju · « **Reply #37 on:** January 18, 2016, 04:47:53 am »

hi, samson
I bought thro BSNL my service provider. I do not know about others having this problem. I am surfing the net. i have taken the prsc of the settings, of the modem. Incase anything fails. i have to search for the manual. I was given a cd for configuring. If i try again, that may lead to something , again prompting me to approach service personel.
Is there any wifi scanner, that would scan and fix this virus without affecting the internet access?Thank you for all the tips.

Samson · « **Reply #38 on:** January 18, 2016, 04:56:30 am »

You keep calling it a "virus", Avast has flagged it as a vulnerability, NOT a virus. This can only be fixed by a firmware update/ patch.

Can you now access the router's settings via 192.168.1.1 from your earlier post, the tech managed it.

jraju · « **Reply #39 on:** January 18, 2016, 04:59:06 am »

Yes . of course. i said that i have taken prscr of my settings. Now, if that vulnerablity is touched, who knows.

Samson · « **Reply #40 on:** January 18, 2016, 05:03:29 am »

Quote from: jraju on January 18, 2016, 04:59:06 am

Now, if that vulnerablity is touched, who knows.

"This vulnerability allows an attacker to easily gain control of the router and therefore your Internet connection. The attacker can use a specially crafted HTTP request to download all important and secret data stored in your router -- your router login/password combination, your Wi-Fi password and your configuration data."

"There is a severe vulnerability in a lot of routers of various brands, models and software versions. The bug allows unauthenticated anonymous HTTP requesters from outside network (from WAN interface) to download configuration file from the router including its passwords to configuration web interface. Attackers massively abuse this vulnerability to gain access and change DNS servers that are used by the router as well as the computers behind it and they redirect high-profile and generally trusted web pages to malware or phishing sites."

You can get a second opinion on Avast's findings here.
http://rom-0.cz/

It is circumstantial and speculative, however you seem to have suffered the symptoms of the vulnerability to which you are exposed. Specifically the inability to be able to login to your router interface could have resulted from the admin password being changed by a malicious source. Coincidence?

Boggin · « **Reply #41 on:** January 19, 2016, 02:52:12 am »

Is there a setting in the router for remote access that you can disable ?

This is what ISP techs use to access the router but I suppose could also allow an attacker the same access.

See what Netalyzr makes of your WiFi - this requires Java.

http://netalyzr.icsi.berkeley.edu/

Can you let us know the make & model of the router - this can be viewed by going Start - click on Computer and in the left pane, click on Network.

Let's see if we can find some info on its settings.

jraju · « **Reply #42 on:** January 19, 2016, 04:19:00 am »

My network icon on the left if opens show only my printer hp 1300.
I will give the modem name It is teracom modem,TDSL 300 w2 type 2 adsl2+wireless router
The adapter is RealtekRTL8139/810x family fast ethernet NIC.
I ran the netlyzer, but test complete and waiting for results. How to go about getting the results

jraju · « **Reply #43 on:** January 19, 2016, 05:33:45 am »

Hi, Boggins.
there was a feed back session and I sent. I stored the results in png form. The results are some major and minor aberrations. to put it simple.
I will give some results in the next post.
Meanwhile, if it is dynamic ips on every login, how the results could be gauged. If suppose, I quit the browser and then log in , I will be given a different log in by the ISP, as natural and how it is to be analysed. I appreciate the task it took to give those results. Would it be applicable to dynamic ips log ins.
I will analyse the results and if possible, I would like to pm. how to do I do not know

Boggin · « **Reply #44 on:** January 19, 2016, 09:26:12 am »

This is mine which I just used the normal right click on the URL then selected Create shortcut and pasted it into the reply box.

Link removed.

At one time, it used to warn of a vulnerability in the router but I cannot see it this time.

I'll do a search later to see what info I can find on your router.

To check if you are getting a different IP address every time you log in, run this program before and then again after a new log in to see if it changes.

http://whatismyipaddress.com/

EDIT - It looks like not being able to log into this router is a known issue and the only workaround of a factory reset has already been suggested.

http://www.netvuze.com/2013/04/dsl-broadband-modem-configuration.html

Samson · « **Reply #45 on:** January 20, 2016, 04:29:27 am »

Your router may have the option to make a backup of your current settings to a file that you can save and then use to restore the next time that you have to do a reset. Look for a backup option in "maintenace" or "management" in the router interface. This would save time and hassle in future.

jraju · « **Reply #46 on:** January 20, 2016, 04:49:56 am »

Hi, It is the direct link to the site. Is not?
If you are having dynamic ip address, then this is ok.
But if you have static ip, then would it not be pinpointing your ip. Please, if it is static ip, then anybody could use this . Pl clarify. I had not sent the details, even though it is dynamic.
Whenever you log in , you will find new .
Another question: the settings in the router is not that i typed. like the 5 points in ip4 configurations. But when i do not get the internet access, when i call the help desk, i am given some other 5 access points address, which is not found in the router. It is entirely different, but i am getting access.
Is it not that these two are different and getting the access. Pl clarify. If Boggin things, he could just take out the link, giving his internet results.
edit: I set ip4 to auto detect internet and also dns server in present settings.
Still, the internet light first gives red, and after troubleshooting is done, giving the access.

jraju · « **Reply #47 on:** January 20, 2016, 05:32:35 am »

Hi, Boggins Yes checked on this computer
If i plug in after restart , the first time, i got the same ip address
on second attempt after some more minutes, it gives the different ips. I checked with pcwintools site as well as in your link.
While sometime, i get all the lights blinking, sometimes, i get the internet light red on clicking troubleshooting, internet light also starts glowing, and troubleshooter ends with no problem screen.

jraju · « **Reply #48 on:** January 20, 2016, 06:11:04 am »

Hi, Boggins,
so there is no chance of saving the settings from the link. If you copy the link location, you could view the things of result.
I will check the result with the changed ip and try to give the changes noted if any.
Hi, samson,
Thanks for the tip. But going to the page and saving the thing.I want to know that i need not kind of saving the settings, after progressive bar in the maintenance tab. Is it correct.
I could just save the settings in which format. could i able to view on my pc in selected folder or file location.

Boggin · « **Reply #49 on:** January 20, 2016, 06:28:20 am »

I think you need a new router - how long have you had this one and is it still under warranty ?

My ISP - TalkTalk supplies a free router, although now you have to pay for the postage which was once free.

Their routers initially were little better than doorstops but have improved immensely and in the early days when I first signed up to them because of the instability of the connection, I bought my own router.

Do you have an alternate Internet provider who has better facilities.

Are you using wireless or Ethernet as that Realtek that you listed is an Ethernet adapter.

The results for Netalyzr just come up when its tests are complete, but I've never run it on just wired - I'll give it a go and get back to you on that as I'll need to allow Java in browsers which requires a restart of the browser to effect.

I can still view my Netalyzr results by clicking on my link.