This is not a technical assistance but an information to check your routers if your are seeing unexpected pop-ups. After coming back to India, I saw unexpected increase in pop-ups. With pages that worked without issues started giving pop-ups with clicks and sometimes on scroll or click on no links.
I tried looking for reasons of unexpected pop-ups. I found that Airtel and MTNL are injecting pop-ups in pages. Screenshots showed they are not pop-ups but hovering ads. So, I moved on.
I could see even my blog started with the pop-ups. I started observing the ads on pages I visit. These ads looked different. Simply put some crazy, cheap gifs, which are outdated now. It made me remember those age old cyber-cafe days. Now I had to look what these pop-ups are.
Thanks to poor speed, I was able to see the initial redirect link. I could see the pages go through 5-10 redirects before showing adult site, Facebook, page showing my device(s) is infected etc. The main redirect pages seemed to be adcash & rdsrv.
Firefox & Firebug to rescue. I started looking into code of pages. They had some unexpected coding standard another <head><body> HTML statements inside <body>. I looked in my blog. Similar situation happened. I’m using WordPress so I’m sure they won’t do that. Checked my homepage, which is under development since the inception, it’s just a landing page now 🙂 It too had adcash [DOT] com. I did not write it nor Google will introduce something.
adcash & rdsrv are common bugs which find a way to install on PCs or browsers as extension. The issue was showing everywhere, Mac, PC, iPhone, Android, iPad. I don’t use PC much but I’m certain others don’t have bugs or extensions (I avoid extensions except 1Password). Some codes did not have adcash but I found there is some adk [DOT] com. The pages had inconsistency. After reading about adcash & rdsrv bugs, I checked all systems. They were green. Now it was time to router check.
I’ve a MTNL ADSL Modem (Sterlite SAM300 AX) connected to Apple Airport Extreme Base Station. All devices use wifi from AEBS. I can not see if AEBS has infection or the MTNL Modem. I disconnected from Wi-Fi and used hotspot from my device to browse. Web pages looked good. Checked source, no adcash or adk. Awesome!
Connected system to MTNL Modem via LAN Cable. Voila! The bug is back. I had read that AEBS is safe but since the issue is with MTNL Modem, I first thought to correct it.
Step 1: Call MTNL and ask for modem change. That call went for 30 mins (except wait time), trying to explain that Modem has bug while other end was quite sure it is a system/browser issue. Finally the issue reported and I’m waiting for replacement modem.
Step 2: Read about modem. Well actually, how to reset it. Since this is a infection assumed the firmware is still intact and resetting it should give me factory settings. Before Step 2, I did get all required documents to reconfigure. It took me more time to look for a pin to reset than to actually do it. A pen (mightier than a sword) helped me push that button and the word document from MTNL website helped reconfigure. Within minutes, I was up and running without pop-ups.
Till now, a good amount of time, I’ve not seen any pop-up or javascript injection on pages I visit. Now it’s a matter of time I get replacement modem as the bug may return. I could do the firmware upgrade but (being lazy here) since this is quite old, may not be supported or new modems will have better handling of infections. If I’m supplied this again, I might go for a new modem (on my own) altogether.
Do check guys if you see unexpected behaviour with your browser?
- Then check for unexpected software (for PC: Win + R > appwiz.cpl i.e. Control Panel > Add Remove Programs).
- Check for unexpected Browser Extensions (Chrome, Firefox, Safari and others)
- Check Source Code of webpage to see adcash, adk or rdsrv (I’ve not seen this but pop-ups show this too)
- https:// pages seemingly do not exhibit this behaviour (so may not be seen for gmail, Facebook, outlook)
- Visit my page (till I don’t update it), zeronea.com because it does not have pop-ups (and codes written by me or from trusted sources). It does has ads but the above injections break the ads (the Amazon ad below) by showing poorly formatted ads or just Go To Facebook on solid colours
Live Preview of page:
[browser-shot url=”http://www.avxio.com/” width=”1024″ href=”http://www.avxio.com/” alt=”Live Preview of ZeroneA” target=”_blank”]Live Preview of ZeroneA[/browser-shot]
Update (21/07/2015):
The infection is back and I’m still waiting for new modem.
- Check your modem DNS server. Connect to Modem by typing 192.168.1.1 (generally this is used). If you’ve not changed the ID & Password, it should be admin & admin respectively
- You might need to access some documentation from you ISP (or seek information from them) regarding the DNS Address. For MTNL it is under Interface Setup > LAN. Mine was redirecting to somewhere in Germany with secondary to 8.8.8.8 (Google). Checked using ip-lookup.net
- Password protect your modem too.
After 2-3 days it’s back so I’m still working on solution. Hopefully I figure it out. Please let me know how you deal with it.