Solved! The redirect virus was in my router

Does your redirect virus keep coming back, after appearing to be solved by conventional means? It could be in your router. Here’s a possible explanation for what’s happening out there in cyberspace.

Perhaps this virus attacks routers first, and then finds its way onto your computers. If that’s true, it would explain why it keeps coming back. You must get rid of it in your router.

In our case, we think our computers never actually had the virus, because we did a good job at securing them. But it was in our router, so we saw the symptoms. That’s why no amount of extra anti-anything ever made a difference in the symptoms we were seeing.

Our configuration

We have a mix of Windows 7 Professional, Windows 7 Home, and XP computers. Some of them are Lenovo, but not all. Some are laptops. We have both an ethernet connection and a wireless connection. We were using the Linksys WRT350N router. We use a mix of Firefox and Internet Explorer, but mostly Firefox.

Our Security

We always keep our computers clean and secure with:

1. Avast Free
2. Malwarebytes Anti-malware
3. Spybot
4. Secunia (on the advanced level)
5. Windows Defender
6. Ccleaner
7. Windows cleanup!
8. Disk cleanup
9. Process Explorer
10. Passworded hard drives on the laptops
11. Windows update
12. Lenovo Toolbox tests and updates on our Lenovo computers (equivalent on the others)
13. Crashplan

Google Redirect Virus and its alternative names

The virus is often referred to as the Google Redirect Virus. It also goes by “search redirect,” “browser redirect,” “tdss rootkit” and probably some others I can’t remember now. It infected all of our computers. These could actually be separate viruses. Remember that once you’re infected with a virus, the door opens for other infections.

More still seems unknown than known about this virus. Generally, you go to a web page, either by means of search or directly, and you see the web page, but then it redirects somewhere else, or to a blank page. Sometimes you see a message about google analytics loading. Other times you might see an inappropriate site or an advertising site.

Curiously, the web is rife with a variety of solutions which only work for some people. It seems like a lot of people find an answer that works for them, which appears to eradicate the virus from their computer.

Our test cases

Three web pages that failed on my computer and which became my test cases:

1. Open www.lenovo.com, look for the support section of links at the bottom of the page, then click on the warranty link. You either get redirected now, or if you successfully reach the warranty page, click on the link for “detect” (if it’s there.) It then fails.

2. Type into google “ehow fix google redirect virus” and then click on the ehow article that comes up at the top of your search results. Give the page some time to load. Either it will eventually redirect, or will do so after you touch your keyboard.

3. Open www.filehippo.com and click on “view more” at the bottom of the right-hand box. It will eventually fail.

We tried

We tried everything we could find pertaining to this virus on one’s computer. In fact, we worked on it for about fourteen people-hours total. Our idea of a good time. The list includes but is not limited to (we can’t remember it all):

1. Superantivirus
2. Unhackme
3. Clear cache, cookies, and history
4. Remove all browser plug-ins
5. A TDSS removal procedure
6. Avast Pro (trial version)
7. Trojan remover
8. Some gnarly instructions for mucking with the registry
9. Combofix (not for the faint of heart)
10. Unique wep key for the router
11. Check for bad hard drive sectors

Still no joy.

Time to reinstall?

Then we tried reinstalling Windows 7 on one of our computers, and the virus was back. Exhausted, we concluded (wrongly, it turns out) that this was a hack on the web sites we were visiting, and not in our home.

New Theory — maybe it’s the router

Then we theorized that the virus could be in the router’s operating system. So we tried this suggestion we found on the web for our router: Update the firmware on the router. (The firmware is the router’s operating system.)

Still no joy. We concluded that it must be that the web sites were hacked into — in other words, there’s nothing wrong with the patient.

Then we learned that a router can be hacked, probably by the following means:

The hacker creates a false DNS (domain name server) out on the web, and then stuffs the IP of their fake DNS into your router.

Well, if this is true, then HOW DID THE HACKER GET INTO OUR ROUTER? Probably they got in there because we didn’t change the default password of the router when we got it. This is a lame excuse for sure, but looking back, the reason we never changed our password is because we couldn’t figure out how. (The router password is for changing router settings. It’s not the same as the WEP key.)

So we looked at the IP address in our router, and looked it up on the web. We learned that it’s a Russian IP address, and that it’s malware. Bang.

Fixing the Router — Part One

We followed this procedure to update the password in our router:

1. Fix the IP address. We did this by looking up a good DNS server IP address. A place to google is “opendns” where you can find IP addresses that are well known to be safe

2. Open your browser

3. Type in http://192.168.1.1 which will bring up the administration panel of your router

4. Then follow the instructions for your particular router to find the bad IP address and replace it with a safe one.

So we tried that.

JOY! Yay!

Fixing the Router — Part Two

But we had to do more. Just as we suspected, not all our test cases passed the test. The google analytics test still failed, while the others passed.

Then we looked up that particular problem, and found a suggestion to “hardware reset” the router to factory settings, followed by a change in password. That’s the paper clip procedure. Not sure if it’s the same on your router, but here’s what we did on ours:

1. With the router turned on, shove a paper clip into the reset button and hold it for a few seconds.
2. Then run your test case again.

JOY JOY JOY. All three test cases passed after we did the paper clip trick.

Fixing the Router — Part Three

You might not need to do part three, but here’s what happened to us: We lost access to our wireless network after the hardware reset. We’ve heard that “hardware resetting” your router can burn it out, so maybe that’s what happened. Probably the card in the router that controls the wireless connection got fried during the reset. That’s a guess.

So we figured we’d just go out and buy a new wireless router, as a way of seeing if this was so. We could always return it, as we use Best Buy, and they have no restocking fee on small electronics like a router. In the store, we discovered a new kind of router. It’s the Linksys E3000.

Why our new router is better

What’s good about this new router:

1. It has an automated setup for all your computers
2. It comes already uniquely passworded, and with an easier user interface to update the password if you so choose
3. It has a higher level of encryption than our old router (it’s using WPA2 instead of WEP).

However, buying a new router is perhaps not necessary. We only did it because we fried our wireless.

All problems solved

So we set up our newly bought router, and now our wireless works.

The order in which to try and solve the problem

If you think you may have the redirect virus, try these steps in this order, based on what we’ve learned:

1. Get rid of it in your router first, by following what we did for ours.

2. Then, with only one computer on, and not connected to the router, follow all the conventional suggestions for getting rid of it (except combofix). Now connect that computer to the router and test.

3. Turn on the next computer, and repeat step 2. Continue until you have treated all your computers. We suggest only using combofix as a last resort, and only with the help of the folks at bleepingcomputer.com. See if you can get rid of the virus without it. We think your chances are pretty good.

4. Reinstalling your OS is a last resort, and probably wouldn’t solve the problem. If you had what we had, you really have to attack this both on your computers and in your router.

Our new Linksys router acknowledges the hacker vulnerability

Yes indeed folks. There was a label covering the CD drive on our new router. It says it all.

In case it’s hard to read here, this is what it says:

“FOR YOUR SAFETY. During the setup process your Linksys router will be assigned a unique password to help protect its wireless signal from unauthorized access. If you wish to change this password, please follow the instructions in the User Guide at linksys.com/support.”

Our grand conclusions

1. Our computer security had been fine all along. It’s still true that you can fully protect your computer with free stuff. I’ve even become brand-loyal about it. I’ll stick with my list.
2. Routers need protection too. They’ve been woefully ignored (well, at least by us!)

Those pesky IP addresses we found on our router

Here is the post we found about the Russian malware sites with the exact IP addresses we found on our router. The IP addresses are:

213.109.65.40
and
213.109.75.90.