Help - router constantly hacked

Massive Attack

Massive Attack

Massive Attack

Permabanned
Joined
9 Aug 2006
Posts
2,273
hi guys i have a netgear DG834GT with the latest firmware, i have wireless disabled as i dont use it and WPA security also have a 16 charachter password but the password is being changed by someone else and i dont know how, i constanly find the internet slow i dont know how to do to secure it better. ive got 2 software firewalls also which i have been using for years
 
Last edited:
Try turning on the "MAC Filter" and only allow your NIC MAC to connect to the router, if there is no MAC filter, try changing the IP address of the router, also enable the "Wireless MAC Filter" and set it to "Deny".
 
Last edited:
by default it should only allow connections to the routers settings from a computer on the LAN, if you are sure the remote connection thing is disabled, then the only alternative is one of the computers on the LAN is compromised, and the attacker is connecting to the router through the compromised computer.
 
Dist said:
by default it should only allow connections to the routers settings from a computer on the LAN, if you are sure the remote connection thing is disabled, then the only alternative is one of the computers on the LAN is compromised, and the attacker is connecting to the router through the compromised computer.
Click to expand...

ahhh didnt think of that, the remote managment thingy is defo disable although there is a compromised computer on the network gonna have to get that sorted somehow
 
Run a good AV package (e.g. NOD32) on each system on your network, whilst it is disconnected from the Internet.
 
What evidence do you have anyone has hacked your router ? Your internet could be slow for a number of reasons, is it any quicker with just your PC connected to the router ? If not how about with just one of the other PC's connected ?

To put it bluntly it doesn't have to be anything so sinister, any chance another member of the household hit the reset button and set up a different password ? Or you made a tpyo ?
 
Avalon said:
What evidence do you have anyone has hacked your router ? Your internet could be slow for a number of reasons, is it any quicker with just your PC connected to the router ? If not how about with just one of the other PC's connected ?

To put it bluntly it doesn't have to be anything so sinister, any chance another member of the household hit the reset button and set up a different password ? Or you made a tpyo ?
Click to expand...

the evidence i have is that my router password is being changed without my permission, this moring i woke up wanting to go onn the internet but for some reason it was disconnected, i manually reset it and loaded a backup file, guess what it was working fine after that
 
I'm not convinced someone outside your local network is tocuhing your router either.

Are you making sure you save any changes you make to your router configuration properly?
 
Unplug all PCs except yours.

Do a hard reset of the router. (just in case)

Turn off the wireless.

Change the admin password.

Now... I'm pretty sure that there's something in the Netgear settings that allows you to control access to the admin panel by IP address. If so, make sure yours is the only one on it.

Remove the WiFi aerial.

Plug the other PCs back in.
 
Massive Attack said:
the evidence i have is that my router password is being changed without my permission, this moring i woke up wanting to go onn the internet but for some reason it was disconnected, i manually reset it and loaded a backup file, guess what it was working fine after that
Click to expand...

im confused. your connect via a cable right? so you shouldnt need a password to get on the network, thats for wireless only.

soo.....how do you know if the password has been changed when you cant get on the net or access the router? and why would a wireless password affect your internet access?


i think your router is failing. something is causing it problems. anybody running any p2p software? azureus brings my routers to their knees, both of them (wrt54g and an all singing all dancing linksys wireless-N supposedly 'enterprise' class router). it also, incidentally, brings vista down with it. only a reboot will get it up and running again.
 
Massive Attack said:
well i was readin up on the interent an apparently you can connect to a non broadcasting network, i honestly dont get it.
Click to expand...

Wireless being disabled and having a non broadcasting SSID are different things. If your sure its the wireless they're connecting over, try and remove the aerial.

I agree with the others though and it does sound like someones compromised one of your computers. Make sure your own computer is clean (AV scan and then use Spyware/Ad-Aware) and try plugging in other computers one at a time and see when it slows. At least that way you know which one is being used.
 
Massive Attack said:
the evidence i have is that my router password is being changed without my permission, this moring i woke up wanting to go onn the internet but for some reason it was disconnected, i manually reset it and loaded a backup file, guess what it was working fine after that
Click to expand...

That proves nothing other than your connection wasn't working and you had to reboot your router. It could be a hardware fault, a line/sync issue or a whole host of other things.
 
Check the logs to see if anybody is logging on as admin but if you're having to reset the router to get in I think the logs will be cleared. Also check the firmware and upgrade if needed, then clear the config and put it back in with MAC address reservations on both the IP and wireless side.
 
Avalon said:
That proves nothing other than your connection wasn't working and you had to reboot your router. It could be a hardware fault, a line/sync issue or a whole host of other things.
Click to expand...

seconded

your not being hacked, your connection is just flakey
 
You must log in or register to reply here.
Back
Top Bottom