Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For a while now I've been almost certain this is the case. Definitely, at some point, malware on my stepkid's laptop gained access to the home network and managed to change some settings.

Router is a D-Link DIR-615.

share|improve this question
3  
You're gonna want to reset the router to factory settings. –  digitxp Dec 30 '10 at 0:12
7  
Not sure why this is off topic... I don't think it is... –  BloodPhilia Dec 30 '10 at 0:18

2 Answers 2

up vote 5 down vote accepted

Not an easy way. I would recommend downloading and installing the latest firmware for it. The exact file will vary depending on the version of DIR-615 you have. After doing that I would recommend that you:

  • Change the administrative password using a strong password
  • Secure the the wireless with WPA. WPA 2 if supported.
  • Be sure that remote administration is disabled
  • Setup the router to use a third-party dns ala google dns or opendns
  • Save a backup copy of your settings
  • Disable UPnP

Doing these things will help secure your router, but in the event that it is compromised you should be able to compare the settings with your backup copy and verify your DNS is going through Google or OpenDNS.

share|improve this answer
2  
Note that the administrative login and password should follow best practices and make sure to turn off UPNP (universal plug and play) on the router software. –  Blackbeagle Dec 30 '10 at 1:52
    
Made edits to reflect your comment. Completely agree. –  sdanelson Dec 30 '10 at 2:02
    
Nice summary. +1 for WPA2. –  user3463 Dec 30 '10 at 3:30
    
+1 to disabling remote administration. –  SgtOJ Dec 30 '10 at 3:37
    
+1 and accepted this answer. Thanks for mentioning Google DNS. –  ixtmixilix Jan 16 '11 at 19:39

Yes, your router can be mangled by malware, either by settings getting changed, or even bogus firmware loaded into it.

If you believe it has been hacked, take the possibly infected computers off the network, then reset the router to factory defaults and then change the admin password and disable remote administration. If there are firmware updates available, download and install them, again making sure that the admin password is different from default and remote admin is disabled.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.