Here's how to Antivirus scan your router for malware and remove it

Here's how to Antivirus scan your router for malware and remove it

Router malware is rare, but that doesn't mean your router is invulnerable. A hacked or infected router provides the perfect attack surface for cybercriminals to manipulate your Internet traffic or to gain access to other devices in your network. Here you will get tips from experts on how to get rid of a router infection and then protect your network from further attacks using a special Total security tool.

In recent years, Internet security experts have increasingly come across malware that attacks routers while doing their research. A well-known example is the Switcher Trojan, which hacked Android devices in 2016 in order to manipulate the owner's router settings.

As soon as the router malware of the Switcher Trojan was installed on a smartphone, it attempted to gain access to the mobile phone owner's router using a brute force attack. In this method, the hacker tries a thousand different passwords and user data combinations until he finally finds the right one. (This is why it is so important that you protect your router with a strong and unique password.)

As soon as the hacker has access to the router, he changes the DNS settings so that the traffic is redirected to the servers of criminals. This type of attack is called DNS hijacking and since a router infection can affect an entire network, all devices connected to the network are at risk.

VPNFilter is a new type of router malware. Unlike Switcher, VPNFilter directly attacked routers via a worm that made its way through known security vulnerabilities, and the only way its victims could remove it was to hard reset their router. It is estimated that over half a million devices worldwide were infected by VPNFilter in mid-2018.

In 2019, our threat experts here at AVG observed a noticeably high level of use of the GhostDNS exploit kit to attack victims in Brazil. This type of attack works like this: once a victim visits a hacked website, their traffic is redirected to another website that contains the GhostDNS exploit kit. Now the exploit kit can automatically identify the victim's network router and attempt to hack it. If it manages that and gains access, it changes the victim's DNS settings so that the person concerned will be redirected to phishing websites when surfing in the future.

Can a wireless router get infected with a virus?

Like any other device with an operating system, your router is not safe from malware such as VPNFilter or the Switcher Trojan. While many routers run on a Linux-based operating system, other router manufacturers develop their own systems. The 2018 crypto mining attack on MikroTik routers is a well-known example of how hackers develop malicious scripts that attack specific router operating systems.

The greatest danger for your router is a weak password or another security gap, such as an activated WPS-PIN ( Wi-Fi Protected Setup ). It is much easier to crack a PIN than a long and complex password.