{"id":328,"date":"2014-03-05T19:46:59","date_gmt":"2014-03-05T18:46:59","guid":{"rendered":"http:\/\/www.cbits.co.uk\/ourblog\/?p=328"},"modified":"2015-09-18T11:37:13","modified_gmt":"2015-09-18T10:37:13","slug":"fake-flash-player-update-virus-routers-tp-link","status":"publish","type":"post","link":"https:\/\/cbits.co.uk\/ourblog\/index.php\/news\/fake-flash-player-update-virus-routers-tp-link\/","title":{"rendered":"Fake Flash Player Update Virus & Routers (TP-Link) Update 6\/3\/14"},"content":{"rendered":"

\n\t\"flash-player-update-virus\"<\/a>\n<\/p>\n

\n\t(Updated 6\/3\/14 am) This malware seems to be being delivered as a "Update to Flash Player", which we now think is changing settings in Routers so that ALL DEVICES on the local network are routing to conduit.com servers, we have seen routers where we set server addresses yesterday, and this morning the router DNS changed to 50.63.128.135 (GoDaddy servers in the US) – using just one DNS entry<\/span><\/em>\n<\/p>\n

\n\tWe have had an epidemic of incidents of "Conduit Search engine" Hi-jacks over the last two days, this appears to be  a widespread incident and there are lots of articles on how to remove it on the internet. The most common symptom seems to be an inability to connect to Facebook or Google sites.\n<\/p>\n

\n\t(Kind of makes it obvious you have a problem – I suspect this is unintentional previous – conduit search engine hijacks have left users unaware, simply redirecting them and earning money for Conduit!)\n<\/p>\n

\n\tWhat does seem to be different about this malware is that in many of the instances we are finding that users are re-infected after their PC has been cleaned or that the problem extends across several \/ all devices on the users premises, the fake flash update warning is happening on Macs, iPads , Android tablets and several smartphones (we don't yet know if it is successful at infecting all these devices but it can hijack IE, Google Chrome, Safari, Bing at least so it seems any browser can be "got at")\n<\/p>\n

\n\tNow the common denominator we are finding, that (as yet), no-one else seems to be seeing is that it is able to change settings in some network routers, specifically is is changing the DNS servers to point to:
\n\t199.223.212.99<\/span>
\n\t199.223.215.157<\/span>\n<\/p>\n

\n\tThese are servers located in Virginia USA, and we suspect are directing queries to Conduit Search, so as long as this setting remains in the router , any user is using Conduit to search the internet and will rapidly become infected with Conduit and it's accomplice's malware products (are these evil things products??)\n<\/p>\n

\n\tIn nearly all the instances we have found so far the router involved has been a TP-Link one, (15:30 6\/3\/14 – we have just had our first non-TP-Link  router which has been affected an Edimax model – we are not yet sure which one) <\/span><\/strong>we don't know at this stage if this simply reflects their market share or if they are especially susceptible, or even specifically targeted by this Malware. We have advised TP-Link UK of our concerns around lunchtime today but as yet have disappointingly received no response. TP-Link have now confirmed that they have "other reports", and we have updated them on the situation we are hoping for a technical response from them shortly<\/span><\/em>\n<\/p>\n

\n\tWe haven't yet found all the answers to this situation and are currently manually changing the DNS in any routers involved, and clearing any machines of malware individually.\n<\/p>\n

\n\tThis appears to be a variation on the Router Hacks explained here<\/span><\/em><\/a>\n<\/p>\n

\n\tSo far on iPads, iPhones and Android devices we are finding that clearing the Browser History settings seems to enable them to reconnect (we don't yet know if there is any residual malware here however.)  We now have reports that on Android at least clearing browser history seems to be all that is needed,  we recommend using <\/span>Malwarebytes <\/span><\/a>to check Android devices, and perhaps Lookout (I have used Lookout for some time and we have experience of Malewarebytes on PC so we know it is reputable – many claimed anti-Virus \/Malware \/ Security apps are in fact quite the opposite so huge caution please!)<\/span>\n<\/p>\n

\n\tAs yet we have no info about Mac's (iOS) but assume that as the browsers can be infected any Mac's should be scanned with suitable Anti Virus software (More as soon as we can)\n<\/p>\n

\n\tIf you feel you may be affected or can provide us with your experience \/ additional information<\/span><\/em> please contact us immediately via www.cbits.net or leave a message on 0844 504 2986\n<\/p>\n

\n\tI will update this post with developments as we get them.\n<\/p>\n

\n\tLINKS:\n<\/p>\n

\n\tRemove "Fake Flash Virus"<\/strong>
\n\thttp:\/\/www.fixyourbrowser.com\/removal-instructions\/remove-flash-player-update-popup-scam-virus\/<\/span>\n<\/div>\n
\n\t <\/span>\n<\/div>\n
\n\tConduit info & Uninstall<\/strong>
\n\thttp:\/\/itnewsyoucanuse.com\/2013\/06\/28\/349\/\n<\/div>\n
\n\thttp:\/\/forums.anvisoft.com\/viewtopic-45-5152-0.html<\/a>\n<\/div>\n

\n\t \n<\/p>\n

\n\t \n<\/p>\n

\n\t <\/p>\n","protected":false},"excerpt":{"rendered":"

(Updated 6\/3\/14 am) This malware seems to be being delivered as a "Update to Flash Player", which we now think is changing settings in Routers so that ALL DEVICES on the local network are routing to conduit.com servers, we have seen routers where we set server addresses yesterday, and this morning the router DNS changed […] Read more »<\/a><\/p>\n","protected":false},"author":10,"featured_media":331,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[21,13,38,60],"tags":[116,117,115,55,7,33,114],"class_list":["post-328","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-browsers","category-news","category-os","category-virusmalware","tag-conduit","tag-edimax","tag-flash-update","tag-malware","tag-router","tag-security","tag-tp-link"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4tvbq-5i","jetpack_featured_media_url":"https:\/\/cbits.co.uk\/ourblog\/wp-content\/uploads\/2014\/03\/flash-player-update-virus.jpg","_links":{"self":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts\/328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/comments?post=328"}],"version-history":[{"count":12,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts\/328\/revisions"}],"predecessor-version":[{"id":753,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/posts\/328\/revisions\/753"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/media\/331"}],"wp:attachment":[{"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/media?parent=328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/categories?post=328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cbits.co.uk\/ourblog\/index.php\/wp-json\/wp\/v2\/tags?post=328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}