2

From couple of days I had on my laptop Adcash.com popup on Chrome, I tried to delete all the cache and cookies but it still exists.

Then I found the same popups on my Android phone and another phone and PCs in my house. I was kinda shocked and used Kaspersky & Malwarebytes on both phone and laptop. Nothing was found!

This means, there is no virus or malware on my PC!

Is there a way to remove it? or it's something normal!

Dave
  • 25,405
user455269
  • 21

1 Answers1

2

Yes! Adcash is malware!

Does this happen when using another Wifi network, or when on 3G/4G? If this happens with any browser and with any computer or device, it could mean that you router got infected by drive-by-hijacking.

You visited a site with a malware script that logged into your router and changed the DNS settings. This works only if the router has a default admin password. It just tries and then changes the DNS in the router. Changing the DNS they can reroute all traffic if they want to. All computers that use DHCP and use the router DNS settings will use the changed DNS of the hijackers.

The malware will infect all devices it can infect, so probably the popups will appear if you use another network as well. For devices that cannot be infected, they will work without problem on other (clean) networks.

I can't tell of course if this is really the case. But if so, it's potentially dangerous. Don't use online banking until you're sure this is not the case! Other sites involving money or valuable information (email) - same story!

  1. First thing you could do is disconnect the router/modem from the internet, login locally and check the DNS.
  2. Change the password of the router if it still has the default password!
  3. Check (and change) DNS settings for all your computers and devices as well.

You can change the DNS to 8.8.8.8 and 8.8.4.4 (Google DNS service) or use OpenDNS. This can be set for each computer, which then ignores the router DNS. Even if you don't like Google to see each DNS request, this is a good method to test and to be sure that you're using a service that you can be trust to be reliable.

If DNS hasn't changed, then probably you can forget about this answer. And even if this is not the case - be aware that something like this could happen.

SPRBRN
  • 7,722
  • Same thing happened to the network in our our family cabin. However, it was not the router that had a new, malign, DNS setting. It was the ADSL modem (D-Link dsl 320b). It had a default login that hadn't been changed. – FredrikD Jul 12 '15 at 18:38
  • Isn't the ADSL modem a router as well? If you can login to it, it probably is. – SPRBRN Jul 12 '15 at 20:42
  • No, see http://www.dlink.com/se/sv/support/product/dsl-320b-adsl-2-ethernet-modem It has a management interface that allows you to set various parameters, e.g. default DNS. Changing the password didn't help, the malign settings were back the next day. Received a new image from D-link, will see if it helps. – FredrikD Jul 14 '15 at 07:47
  • You changed the password of the modem. Is it still the same? You changed the DNS in the modem. Did the popup disappear then? Now the malware is back, has the DNS changed in the modem? Or in your laptop? – SPRBRN Jul 14 '15 at 09:01
  • Yes, changed the DNS to the correct one. Changed password. Next day, another DNS. Called D-link support since there was no new image for the device. Now updated. All devices I checked (quite a few with 3 or 4 per person) were set to acquire DNS, this was not changed. – FredrikD Jul 14 '15 at 09:20
  • What about your provider? If this is their modem, they should fix it, probably by replacing it with another brand. Set all devices to use OpenDNS or Google DNS. – SPRBRN Jul 14 '15 at 10:29
  • Good point reg DNS. In Sweden, most providers no longer supply an ADSL modem as part of the service. You buy it yourself. So the systematic failure is the flexibility of the device combined with manual update of the operating system. Now, with the new image mailed from D Link, all is ok. – FredrikD Jul 14 '15 at 14:37