Possible modem/router malware?

[burntbread]

Hi,

I'd first posted this thread in the Computer Help section but was told to come here so am posting it again.

The problem
Certain websites (Facebook, Microsoft Security Essentials, certain forums etc.) will not load on my Macbook (running OS X 10.7) when I am connected to my home Wi-Fi network. The websites in question open on the computer when I use other Wi-Fi networks and other devices report the same issues on my home network so I am certain that there is something wrong with my home Wi-Fi internet connection. I am using an Asus DSL-N10E as a modem that is connected to an Apple Airport Extreme (2013 tower model) for Wi-Fi.

History
This issue first surfaced about a year ago when I couldn't get Windows and security updates on my work PC. After weeks of trying to solve the issue on various forums (documented here, here and here) I began to suspect that my router had been infected and tried connecting to the Internet via a 3G data stick. This worked fine and I was able to get Windows Updates and security software installers. I then went and formatted my computer, reinstalled Windows 7, and got a brand new modem and router. However, the issue persisted. I was then told by a local computer engineer that the problem arose due to viruses and malware coming from the ISP. I couldn't understand how this could be the case, especially since none of my computers were infected but I had no options left and so I changed my ISP and the problem went away. I am based in India. My original ISP was BSNL Broadband and I later switched to Tata Docomo wired broadband. Everything worked well for about a year.

The problem, like a many-headed hydra, is now back!

Questions

1. What is causing this issue? I've run all sorts of test the first time this issue came up (as can be seen from the links above) and they have all come clean. Have my security and privacy been compromised and given that I have been using this computer for the past year do I need to worry about changing all of my passwords etc.?

2. Could this be a BIOS virus/malware?

3. How could I identify the issue and resolve it once and for all?

I am at a complete loss as to what to do next and would really appreciate some help!

 

[Fardringle]

If the computer works fine on all other connections, and other computers have the same problem while on the home connection, then it has to be a problem with the Apple router, the DSL modem, or the DSL connection itself (and/or ISP hardware).

What happens if you connect one computer directly to the DSL modem without using the router at all? Do you still have the same issues? If not, then there's a problem with the router and it might be worthwhile to do a factory reset on the router and possibly look for a firmware update. If you still have the same problem when not using the router, then it's a modem/ISP issue.

 

[burntbread]

That's what has me so befuddled. When the problem first cropped up I was using a different ISP and a different modem (with an inbuilt router) and the Apple router (which is new) wasn't a part of the setup. I've changed all the equipment, along with my ISP, and now have the same exact problem again!

 

[JackMDS]

Call the ISP and discuss it with them too.

Try to hard reset the Modem.

Try to To change the DNS setting in the Router to a 3rd party DNS service (like 4.4.4.4).

 

[burntbread]

I'll talk to the ISP. I tried the hard reset last year when the issue first arose but it didn't help. I tried using Google's DNS on the Airport Extreme yesterday and that didn't help either.

Strangely, this morning things seemed to be working again and the problem disappeared. However, I feel very uncomfortable not knowing what is up. Could my modem/router have been compromised? If so, what do I do to test this? As I've said before, both the modem and the router are new (different from the ones that exhibited this problem first last year) so I don't know how they could have been infected in the first place.

 

[JackMDS]

The incidence of compromising End-Users Routers per-se are very low.

They usually occur on a personal level when someone specifically targeting a specific user and can obtain the specific credentials to do so. It is Not a general occurrence for spamming and malware and the like.

Blocking you in specific from "Facebook, Microsoft Security Essentials, certain forums" is not going to provide anything to a general Spammer malware operator.

 

[alkemyst]

You say home, but this sounds like exactly how domain/corporate network policies would work. Does someone else have control of your network as well?

 

[burntbread]

You say home, but this sounds like exactly how domain/corporate network policies would work. Does someone else have control of your network as well?

I don't understand what you mean by "You say home, but this sounds like exactly how domain/corporate network policies would work". I have one internet connection, one modem, and one router and live in a relatively secluded place where my neighbors are outside the range of my Wi-Fi. My mother and I use the network regularly and I am the one who set it up. Occasionally guests to the home use it too. No one else has control of the network.

 

[John Connor]

Try changing your DNS like was mentioned. I never heard of malware infecting a router or modem especially since inherently routers have a SPI firewall.

Try DNS from OpenDNS.

208.67.222.222 and 208.67.220.220

http://pcsupport.about.com/od/browsers/f/change-dns-server.htm

 

[John Connor]

BTW, MSE is just a baseline scanner to be used with another product.