2

From couple of days I had on my laptop Adcash.com popup on Chrome, I tried to delete all the cache and cookies but it still exists.

Then I found the same popups on my Android phone and another phone and PCs in my house. I was kinda shocked and used Kaspersky & Malwarebytes on both phone and laptop. Nothing was found!

This means, there is no virus or malware on my PC!

Is there a way to remove it? or it's something normal!

  • Do these pop ups only occur on certain websites or all websites? Do you share any plugin's with the browsers? – Dave Jun 4 '15 at 12:18
  • Look at the Lookout Ad Network Detector. It may indicate a common application that is using that particular ad network. – Frank Thomas Jun 4 '15 at 12:18
  • @Dave it happens in any websites that allow ads and I use AdBlock plus – user455269 Jun 4 '15 at 13:10
  • 1
    @Dave Good point – Jon Jun 4 '15 at 14:09
  • It's not enough to delete all the cache and cookies, you need to delete "AppData" or local settings of your browser and maybe some adware program that installs plugins. – Davidenko Jun 4 '15 at 14:37
2

Yes! Adcash is malware!

Does this happen when using another Wifi network, or when on 3G/4G? If this happens with any browser and with any computer or device, it could mean that you router got infected by drive-by-hijacking.

You visited a site with a malware script that logged into your router and changed the DNS settings. This works only if the router has a default admin password. It just tries and then changes the DNS in the router. Changing the DNS they can reroute all traffic if they want to. All computers that use DHCP and use the router DNS settings will use the changed DNS of the hijackers.

The malware will infect all devices it can infect, so probably the popups will appear if you use another network as well. For devices that cannot be infected, they will work without problem on other (clean) networks.

I can't tell of course if this is really the case. But if so, it's potentially dangerous. Don't use online banking until you're sure this is not the case! Other sites involving money or valuable information (email) - same story!

  1. First thing you could do is disconnect the router/modem from the internet, login locally and check the DNS.
  2. Change the password of the router if it still has the default password!
  3. Check (and change) DNS settings for all your computers and devices as well.

You can change the DNS to 8.8.8.8 and 8.8.4.4 (Google DNS service) or use OpenDNS. This can be set for each computer, which then ignores the router DNS. Even if you don't like Google to see each DNS request, this is a good method to test and to be sure that you're using a service that you can be trust to be reliable.

If DNS hasn't changed, then probably you can forget about this answer. And even if this is not the case - be aware that something like this could happen.

  • Same thing happened to the network in our our family cabin. However, it was not the router that had a new, malign, DNS setting. It was the ADSL modem (D-Link dsl 320b). It had a default login that hadn't been changed. – FredrikD Jul 12 '15 at 18:38
  • Isn't the ADSL modem a router as well? If you can login to it, it probably is. – SPRBRN Jul 12 '15 at 20:42
  • No, see dlink.com/se/sv/support/product/dsl-320b-adsl-2-ethernet-modem It has a management interface that allows you to set various parameters, e.g. default DNS. Changing the password didn't help, the malign settings were back the next day. Received a new image from D-link, will see if it helps. – FredrikD Jul 14 '15 at 7:47
  • You changed the password of the modem. Is it still the same? You changed the DNS in the modem. Did the popup disappear then? Now the malware is back, has the DNS changed in the modem? Or in your laptop? – SPRBRN Jul 14 '15 at 9:01
  • Yes, changed the DNS to the correct one. Changed password. Next day, another DNS. Called D-link support since there was no new image for the device. Now updated. All devices I checked (quite a few with 3 or 4 per person) were set to acquire DNS, this was not changed. – FredrikD Jul 14 '15 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.