Internet was blocked for a so called virus????????

[Dantheman2000]

My internet was blocked twice for apparently having a virus I was not aware of. The second time we called the tech support they told us to do the same procedure as the first using the anti virus  provided over an email. I had done that hole procedure before and no infection was detected on any of my laptops. I was even suggested an anti virus by the second tech guy which I scanned my main laptop and still no infection. So IM very confused on what the problem may be. He told me of a virus that could get by the virus things but even after the one he had recommended to me which is a strong anti virus apparently... Still nothing... And my main laptop is brand new. Im still left confused because I do not know of any virus going on at all. And I can keep having my internet blocked as I'm a college student and really need the internet for my studies. 

***edited labels***

[Datalink · Accepted solution]

@stockylobster there's two possible choices here:

1.  You have a botnet infection; or

2.  The destination IP address has been attacked by someone using a spoofed IP address (yours).

The destination IP address belongs to Clara.net in Portugal. 

https://bgp.he.net/ip/195.22.26.248#_whois

The details specify a TCP attack on port 80, which would be the http log in port on modems or routers.  That looks like a report from an Intrusion Prevention System running on a router. 

I would scan any connected devices with more than one antivirus application.  For windows desktops/laptops, consider loading Malwarbytes Antimalware as a secondary scan application.  I use that for a secondary application:

https://www.malwarebytes.com/mwb-download/

There is also a version for Android, IOS and Android.

Are you running the modem in Gateway mode, or in Bridge mode with a router behind it?  If you have a router running, check for the latest firmware update.  If its older than a year and doesn't look like there are any updates on the horizon I'd strongly consider binning the router and buying another one that will be updated with recent firmware updates.  In any event, if you have a router running, consider running a factory update and set the router up from scratch.  Don't load a backup config file. 

To check the UUID for your windows platforms, at a command prompt enter the following command:

wmic csproduct get "UUID"

Compare the UUID result with the UUID's listed in the report from Rogers, just to see if there's a match.  I haven't looked up how to find the UUID for MAC's or Android or IOS devices.

[Gdkitty]

What usually happens with these shutdowns, is due to what they call a botnet. Usually used by a malicious party to do bad things and send out a lot of other bad viruses, etc.

Botnet's usually don't show up on regular virus scanners.

You might want to try some specific botnet removal tools.

[jand_ottawa]

1) I hope this did not start with an incoming phone call claiming to be from Microsoft or Windows saying "your computer is sending virus"... DO NOT EVER follow instructions from someone on an unsolicited phone call. They will have you install software which allows them to take over your computer. They aren't who they say they are ...

I hope instead that your internet went down and *you* initiated the call in to Rogers who confirmed you had been shut off and why. Then it would be okay for Rogers to help you by remote.

2) You mentioned you were a student. Ensure that you have taken the appropriate precautions to ensure your computer when using publicly accessible networks such as at school, libraries, coffee shops. Unis are prime sources of abuse.You set yourself up as an admin user with password, delete the default admin and guest users, anti-virus kept up to date and firewall on, file& folder sharing, remote desktop, screen sharing, bluetooth, wifi sharing, etc all turned off when you are not actually using them. Turn off autorun for USB sticks, avoid sharing sticks, etc...

3) I recommend Major Geeks for help with stubborn infections.

[Moonwolf]

Not going to make a new thread since this one exist.

I got a call last week to say i have a virus on my system. Please check your rogers email for more informations. I check and there was nothing about it and just for the heck of it I did a full scan with Nod32 and Malwarebyte on my computer and family.

NOTHING!

Again got a call yesterday to say I have a virus and to check the email. Again NOTHING.

I check the phone number and sure enough it is from Rogers.

What the deal?

[Gdkitty]

Those programs may not find what it is.. most of the ones that are effected this way are usually a ROOT KIT type virus 😞

What is usually happening, is SOMETHING within your network is spaming outbound.

I have had it happen to me ONCE.  I only had one device on the network live at the times it was happening.. so i knew which PC it likely was.  Got the call a number of days..
Only after i did a format/wipe on my PC, did it stop.

[Moonwolf]

I understand that. Nod32 and Malwarebyte premiun do scan for rookit. Did not find anything. I even download McAfee RootkitRemover and did not find anything either.

And I wont start formatting all PC`s in my house because those tools not finding anything. Just plain crazy, sorry!

[Gdkitty]

Not saying you have to..  just saying thats how I stopped mine.

Double check, just that its not any other device period on the network which could be spaming outward period.

Remove eveything not necessary off the network.. any/all wireless devices.. like cells, connected blurays, etc.

[Moonwolf]

Well the problem is solved.

Call the customer service and explain my situation. Never got an email about the problem in which i was told to look into it for more details. Sure enough it was never sent.

Then the person that have help me told me it was an OpenDns. Turn out it was my cisco router did a firmware update and did not do a proper reboot. After i did the test and done a full reset on my router. Everything was ok.

Here the infos for anyone else having issues.

1. Visit thinkbroadband.com/tools/dnscheck.html and run the test.
2. If the test fails, bypass your router and connect directly into your modem.
   • Re-run the test, if it passes this confirms the issue was in the router, proceed to step 3.
   • If it fails, your computer has a DNS resolver running on it and it will need to be removed or secured.
3. Check your router's firmware version and see if updates are available and/or try to factory reset the router. Upon re-running the test, if it still fails you will need to replace your router to solve the issue.

[Chromus]

Rogers Called Me Saying One of my devices in my household is infected with a virus

Hey all,

just a few minutes ago, I got a phone call with the number 888- something. It notified me that I had a virus on one of my household devices, and told me that if I could not get rid of it within 48 hours, Rogers would shut down my internet. They told me to go to rogers.com/getprotected or check my email that I registered with Rogers and follow the instructions there. I checked my email but there was nothing there. I'm 99% sure that this is a fishing scam, but I just want to confirm just in case.  

[RogersMoin]

Hello, @Chromus

Welcome to the Rogers Community Forums!

If it was an automated call and you were asked to contact Rogers' technical support, I can confirm the call was from Rogers.

I will reach you out through our CommunityHelps message box. Please check our message via the envelope icon that appears on the top right-hand side of your screen when you are logged in to the forums.

Cheers,

RogersMoin