1 ACCEPTED SOLUTION
Accepted Solutions
Looks like we're thinking the same idea, that this is a DNS issue. Looking up 24/7 DNS, it appears that the home country for this site is Russia, which is not good news. If you had not set out to intentionally use a Russian DNS, that is definitely not good news. So, that leads me to think that your DNS has been hijacked, either in the modem, or in the pc or laptop and that you might have an ongoing maleware issue. I always think worst case scenario when I see something like this. With that in mind here is what I would do:
1. Bring up a command prompt and type in: ipconfig/all
When the results are displayed, scroll down and look for the DNS Servers data. If you have a laptop with both ethernet and wifi adapters onboard, there might be main two data sections, one for the ethernet adapter and one for the wifi adapter. Within those sections will be separate DNS Servers data elements. I would like to know at this point what is contained within those sections. And after seeing those results, the next question is, where is that data resident, in the modem or in the pc or laptop? Time to go hunting.
2. Log into the modem and navigate to
a. BASIC .... DNS just to check it out. See if the Lan DNS Obtain is set for Auto or Manual. If its still in Auto, force it into Manual just to see if there is anything hidden in terms of DNS settings. You will see that the page layout changes when you change the DNS Obtain between Auto and Manual
b. BASIC .... GATEWAY FUNCTION to determine if the UPNP setting is enabled or disabled
If the DNS is anything but empty, or, the addresses are something that you did not enter, and the UPNP is enabled, then the modem DNS has been hijacked without your knowledge. That's the danger of leaving UPNP enabled in the modem or router. UPNP can be useful for allowing a gaming console to set the port forwarding rules in the modem or router, but it can also be used surreptitiously by rogue applications to change parameters without your knowledge.
If the DNS Obtain was in Auto and there was no data hidden when it was set to Manual, then the modem will use the ISP DNS, which in this case is Rogers DNS. Every ISP uses their own DNS. This DNS can be overridden by settings in the pc or laptop adapter IPV4 and IPV6 settings.
3. At this point I would run a Factory reset on the modem. Although the modem might be clean, I wouldn't take any chances. Navigate to ADMIN .... DEVICE RESET and select Restore Factory Reset Default Settings by running the Factory Default function. When the modem has completed its restore and reboot, you should reset all of the modem settings from scratch, don't load any data backup file that you might have.
If you haven't seen it yet, when you log into the modem for the first time after a factory reset, with firmware version .21 and beyond, you will see a short series of one time set up pages, which is Rogers new Easy Connect setup. The one thing to remember as you complete this, is that the password that you set for the wifi networks is also the password for modem itself. When this is all done you can log back into the modem using the normal 192.168.0.1 address with the following credentials:
username: cusadmin
password: as you have just entered.
4. Navigate to the BASIC .... GATEWAY FUNCTION page and unless you absolutely need UPNP for a gaming console, I would disable it. Even if you did require it for gaming, for now, I would disable it until everything has been completed. Save the setting.
5. Navigate to the BASIC .... DNS page and ensure that the Lan DNS Obtain either set to Auto, or select Manual and enter your own addresses for the DNS. I would suggest either OpenDNS or Google:
Open DNS: 208.67.222.222
208.67.220.220
Google: 8.8.8.8
8.8.4.4
Save the setting if you have chosen to use either one. If your choice is to use Auto, flip the selection to Manual just to check it out, assuming that there might be rogue application in the pc or laptop that has changed it prior to the UPNP being disabled. Then flip it back to Auto and save the setting. Note that with OpenDNS you can set up an account and set screening options which will give you added security in terms of any address that you attempt to go to.
6. Set the remaining parameters in the modem, including any wifi parameters that you need. Note that at this point, until a malware scan has been run on the pc or laptop, there is still the possibility of a rogue application running that will attempt to change the modem settings. Navigate to Basic .... Port Forwarding and delete any rules that might be present. Save the setting. Navigate to Basic .... Port Triggering and do the same. Save the setting. If any rules were present in the Port Forwarding or Port Triggering Rules, they would have been set prior to the UPNP disable. I would be interested in knowing if you did find any. If you have an Xbox or PS3/4, then there is a good chance that there would have been some port forwarding rules.
7. Knowing that the UPNP has been disabled and that the Port Forwarding and Port Triggering rules are cleared out, reboot the modem. Navigate to ADMIN .... DEVICE RESET and Reboot the modem.
8. When the modem is back up and running and you have reconnected to the modem, bring up a command prompt again and type in IPCONFIG/ALL to recheck the DNS Servers data again. If it is unchanged, as in still showing the same address as before, first recheck the modem's BASIC Lan DNS Obtain fields again, just to ensure that they are either empty, or have the IP addresses that you typed in. If not, ensure that the BASIC .... GATEWAY FUNCTION UPNP function is disabled and saved, and then delete or change the DNS fields, save the data and reboot the modem again.
9. If the modem fields are the same as what you had previously set, then its time to check the pc or laptop. You will need to be in an admin account to do this, or enter the Admin password further down in the procedure . If you have a laptop that has both ethernet and wifi adapters, or you also connect thru an external USB to Ethernet Adapter, you will have to connect the ethernet or USB adapters so that both adapters are visible during the next steps.
a. Navigate to Start .... Control Panel .... Network and Sharing Center .... Change Adapter Settings. If you have more than one adapter available, ie: ethernet and wifi, or USB and wifi, they should show up on the next Networks Connections page. Select one of the adapters and right click to select Properties to bring up the properties panel for that connection.
b. Scroll down to the Internet Protocol Version IPV4(TCP/IPV4). Select that line and then select the Properties function to the lower right to bring up the Internet Protocol Version 4 (TCP/IPV4) Properties Panel. You should see that both selections, to obtain an IP Address and Obtain the DNS Server address are set to Auto. If your DNS has been hijacked in the pc, the DNS Server Address will have been filled in. At this point, you should delete that address and decide to use your own choice as indicated above, or go back to Auto, which will then use the address supplied by the modem. If you use your own address and in the future use a User account on a daily basis instead of the admin account, you shouldn't have any problems with this. When your done, hit the OK at the bottom to close the panel.
c. Next scroll down to the Internet Protocol Version IPV6(TCP/IPV6). Select that line and hit the Properties button to bring up the IPV6 panel. Same situation in this panel, either set for auto to use the modem's address or, set the DNS Server Address to your choice:
OpenDNS: 2620:0:ccc::2
2620:0:ccd::2
Google: 2001:4860:4860::8888
2001:4860:4860::8844
Hit OK at the bottom to close the panel. Note that OpenDNS provides security filtering for IPV4 addresses if you set up a free account and load the OpenDNS Updater so that the filtering service has the modem's IPV4 address. OpenDNS does not provide the same filtering service for IPV6 addresses. Its been on OpenDNS's list for years, but, so far its not in place. It would appear that security filtering that exists in the IPV4 world has not migrated to IPV6 world, so, thats a major consideration with the shift to IPV6 addresses.
Return to step 9.a and select the other adapter and run thru the same procedure to inspect and/or change the IPV4 and IPV6 DNS addresses.
10. Reboot the pc or laptop. After the reboot, bring up a command prompt and type in IPCONFIG/ALL. Check all of the Adapter sections for their individual DNS Server data to ensure that the DNS address are what they should be. I don't have the Rogers DNS Addresses on hand as I've never used the Rogers DNS. If the Modem DNS was set to Auto, and the pc or laptop DNS was also set to Auto, then everything connected to the modem, including the pc or laptop would use the Rogers DNS, unless of course other devices had this same issue.
11. Run a scan of your pc or laptop with the antivirus program that you normally use. Also consider running a sweep with Windows Defender after updating it.
12. Download Malwarebytes Chameleon from the following address:
https://www.malwarebytes.com/chameleon/
That should be a freebie program, essentially a modified version of Malwarbytes AntiMalware to enable the program to run in the event that a running virus or malware program blocks the normal version of Malwarbytes AntiMalware from running. If that isn't a freebie program, download the free version from here:
https://www.malwarebytes.com/antimalware/
13. When the scans are complete, one final check is on the Windows Hosts file. This file is located in:
C:\Windows\System32\drivers\etc
Please have a look at the linked instructions below to inspect and possibly reset the hosts file back to its original condition. Windows uses the Hosts file as the first source of IP addresses. If the requested address is not located within the hosts file, Windows will then go to the Domain Name Server (DNS) to obtain the numerical web address. Its possible for a rogue program to change that file and force specified addresses off to a rogue server. So, at this point its worth looking at that file to determine if its been corrupted in any fashion and if so, to reset it back to the original contents.
http://www.thewindowsclub.com/hosts-file-in-windows
http://www.thewindowsclub.com/how-to-set-the-windows-7-hosts-file-back-to-default
When that Hosts file inspection/modification is complete and you are satisfied that any malicious program has been removed, reboot the pc or laptop. At this point, in theory, your pc or laptop should be clean and your DNS should be running correctly. For security purposes you should be running in a User account on your pc or laptop. If you don't normally do this, you should set up a User account that is used for daily purposes. With Windows 10 you can add an account for someone that you don't have a Microsoft address for, and set it up as a local pc account only, with or without password. A user account has fewer computer admin privileges , so if a rogue application tried to make any changes to your pc or laptop, there is a lesser probability that the changes would be carried out. It may not provide a 100% guarantee, but it will reduce the probabilities. If you used this pc or laptop for financial purposes or on sites that require a password you should strongly consider the possibility that your passwords have been compromised and that they should be changed. Remember, this is just me thinking of the worst case scenario. Everyone has to make their own choices. That should be done on a pc or laptop that you know is clean or by calling into the institution.
14. If you use Firefox, consider loading an Add-on titled FlagFox. It will display a country flag on the right hand side of the address bar so that you can see where the actual site is located. Using a right click on the flag also brings up other options that you can use.
Hope this helps. Definitely a long answer to what appears to be a simple issue. Using a Russian DNS would slow down the page loading as the the DNS request has to travel to Russia and back before the browser or application has the address that it needs to navigate to the site that you have requested.
In terms of the connection issues, are you seeing this on a wifi or ethernet connection? Can you read thru my posts #14 and #16 on the following page regarding the Downstream and Upstream tables, inSSIDer, and Pingplotter and post in the same data that I indicated in those posts. With that info we can address the connection issues:
http://communityforums.rogers.com/t5/forums/forumtopicpage/board-id/Getting_connected/thread-id/3489...
What is the exact message you see? Are you able to post a screenshot, etc?
I myself, have never seen any DNS message for any adult site ever.. i dont think it is anything specifically they do.
Having a site which is possibly NOT on their DNS records? Maybe. But not block..
Are you able to provide any other information?
Are you running rogers online protection or any other similar 'norton' or other internet softwhere which could be monitoring it?
There some settings which can be done on the router side as well which can be used to filter things..
Hi @Kamal--,
This sounds like it could be related to a custom DNS setup. Are you using the default DNS settings? If not, please switch back to default and let us know whether or not the issue persists.
RogersCorey
Looks like we're thinking the same idea, that this is a DNS issue. Looking up 24/7 DNS, it appears that the home country for this site is Russia, which is not good news. If you had not set out to intentionally use a Russian DNS, that is definitely not good news. So, that leads me to think that your DNS has been hijacked, either in the modem, or in the pc or laptop and that you might have an ongoing maleware issue. I always think worst case scenario when I see something like this. With that in mind here is what I would do:
1. Bring up a command prompt and type in: ipconfig/all
When the results are displayed, scroll down and look for the DNS Servers data. If you have a laptop with both ethernet and wifi adapters onboard, there might be main two data sections, one for the ethernet adapter and one for the wifi adapter. Within those sections will be separate DNS Servers data elements. I would like to know at this point what is contained within those sections. And after seeing those results, the next question is, where is that data resident, in the modem or in the pc or laptop? Time to go hunting.
2. Log into the modem and navigate to
a. BASIC .... DNS just to check it out. See if the Lan DNS Obtain is set for Auto or Manual. If its still in Auto, force it into Manual just to see if there is anything hidden in terms of DNS settings. You will see that the page layout changes when you change the DNS Obtain between Auto and Manual
b. BASIC .... GATEWAY FUNCTION to determine if the UPNP setting is enabled or disabled
If the DNS is anything but empty, or, the addresses are something that you did not enter, and the UPNP is enabled, then the modem DNS has been hijacked without your knowledge. That's the danger of leaving UPNP enabled in the modem or router. UPNP can be useful for allowing a gaming console to set the port forwarding rules in the modem or router, but it can also be used surreptitiously by rogue applications to change parameters without your knowledge.
If the DNS Obtain was in Auto and there was no data hidden when it was set to Manual, then the modem will use the ISP DNS, which in this case is Rogers DNS. Every ISP uses their own DNS. This DNS can be overridden by settings in the pc or laptop adapter IPV4 and IPV6 settings.
3. At this point I would run a Factory reset on the modem. Although the modem might be clean, I wouldn't take any chances. Navigate to ADMIN .... DEVICE RESET and select Restore Factory Reset Default Settings by running the Factory Default function. When the modem has completed its restore and reboot, you should reset all of the modem settings from scratch, don't load any data backup file that you might have.
If you haven't seen it yet, when you log into the modem for the first time after a factory reset, with firmware version .21 and beyond, you will see a short series of one time set up pages, which is Rogers new Easy Connect setup. The one thing to remember as you complete this, is that the password that you set for the wifi networks is also the password for modem itself. When this is all done you can log back into the modem using the normal 192.168.0.1 address with the following credentials:
username: cusadmin
password: as you have just entered.
4. Navigate to the BASIC .... GATEWAY FUNCTION page and unless you absolutely need UPNP for a gaming console, I would disable it. Even if you did require it for gaming, for now, I would disable it until everything has been completed. Save the setting.
5. Navigate to the BASIC .... DNS page and ensure that the Lan DNS Obtain either set to Auto, or select Manual and enter your own addresses for the DNS. I would suggest either OpenDNS or Google:
Open DNS: 208.67.222.222
208.67.220.220
Google: 8.8.8.8
8.8.4.4
Save the setting if you have chosen to use either one. If your choice is to use Auto, flip the selection to Manual just to check it out, assuming that there might be rogue application in the pc or laptop that has changed it prior to the UPNP being disabled. Then flip it back to Auto and save the setting. Note that with OpenDNS you can set up an account and set screening options which will give you added security in terms of any address that you attempt to go to.
6. Set the remaining parameters in the modem, including any wifi parameters that you need. Note that at this point, until a malware scan has been run on the pc or laptop, there is still the possibility of a rogue application running that will attempt to change the modem settings. Navigate to Basic .... Port Forwarding and delete any rules that might be present. Save the setting. Navigate to Basic .... Port Triggering and do the same. Save the setting. If any rules were present in the Port Forwarding or Port Triggering Rules, they would have been set prior to the UPNP disable. I would be interested in knowing if you did find any. If you have an Xbox or PS3/4, then there is a good chance that there would have been some port forwarding rules.
7. Knowing that the UPNP has been disabled and that the Port Forwarding and Port Triggering rules are cleared out, reboot the modem. Navigate to ADMIN .... DEVICE RESET and Reboot the modem.
8. When the modem is back up and running and you have reconnected to the modem, bring up a command prompt again and type in IPCONFIG/ALL to recheck the DNS Servers data again. If it is unchanged, as in still showing the same address as before, first recheck the modem's BASIC Lan DNS Obtain fields again, just to ensure that they are either empty, or have the IP addresses that you typed in. If not, ensure that the BASIC .... GATEWAY FUNCTION UPNP function is disabled and saved, and then delete or change the DNS fields, save the data and reboot the modem again.
9. If the modem fields are the same as what you had previously set, then its time to check the pc or laptop. You will need to be in an admin account to do this, or enter the Admin password further down in the procedure . If you have a laptop that has both ethernet and wifi adapters, or you also connect thru an external USB to Ethernet Adapter, you will have to connect the ethernet or USB adapters so that both adapters are visible during the next steps.
a. Navigate to Start .... Control Panel .... Network and Sharing Center .... Change Adapter Settings. If you have more than one adapter available, ie: ethernet and wifi, or USB and wifi, they should show up on the next Networks Connections page. Select one of the adapters and right click to select Properties to bring up the properties panel for that connection.
b. Scroll down to the Internet Protocol Version IPV4(TCP/IPV4). Select that line and then select the Properties function to the lower right to bring up the Internet Protocol Version 4 (TCP/IPV4) Properties Panel. You should see that both selections, to obtain an IP Address and Obtain the DNS Server address are set to Auto. If your DNS has been hijacked in the pc, the DNS Server Address will have been filled in. At this point, you should delete that address and decide to use your own choice as indicated above, or go back to Auto, which will then use the address supplied by the modem. If you use your own address and in the future use a User account on a daily basis instead of the admin account, you shouldn't have any problems with this. When your done, hit the OK at the bottom to close the panel.
c. Next scroll down to the Internet Protocol Version IPV6(TCP/IPV6). Select that line and hit the Properties button to bring up the IPV6 panel. Same situation in this panel, either set for auto to use the modem's address or, set the DNS Server Address to your choice:
OpenDNS: 2620:0:ccc::2
2620:0:ccd::2
Google: 2001:4860:4860::8888
2001:4860:4860::8844
Hit OK at the bottom to close the panel. Note that OpenDNS provides security filtering for IPV4 addresses if you set up a free account and load the OpenDNS Updater so that the filtering service has the modem's IPV4 address. OpenDNS does not provide the same filtering service for IPV6 addresses. Its been on OpenDNS's list for years, but, so far its not in place. It would appear that security filtering that exists in the IPV4 world has not migrated to IPV6 world, so, thats a major consideration with the shift to IPV6 addresses.
Return to step 9.a and select the other adapter and run thru the same procedure to inspect and/or change the IPV4 and IPV6 DNS addresses.
10. Reboot the pc or laptop. After the reboot, bring up a command prompt and type in IPCONFIG/ALL. Check all of the Adapter sections for their individual DNS Server data to ensure that the DNS address are what they should be. I don't have the Rogers DNS Addresses on hand as I've never used the Rogers DNS. If the Modem DNS was set to Auto, and the pc or laptop DNS was also set to Auto, then everything connected to the modem, including the pc or laptop would use the Rogers DNS, unless of course other devices had this same issue.
11. Run a scan of your pc or laptop with the antivirus program that you normally use. Also consider running a sweep with Windows Defender after updating it.
12. Download Malwarebytes Chameleon from the following address:
https://www.malwarebytes.com/chameleon/
That should be a freebie program, essentially a modified version of Malwarbytes AntiMalware to enable the program to run in the event that a running virus or malware program blocks the normal version of Malwarbytes AntiMalware from running. If that isn't a freebie program, download the free version from here:
https://www.malwarebytes.com/antimalware/
13. When the scans are complete, one final check is on the Windows Hosts file. This file is located in:
C:\Windows\System32\drivers\etc
Please have a look at the linked instructions below to inspect and possibly reset the hosts file back to its original condition. Windows uses the Hosts file as the first source of IP addresses. If the requested address is not located within the hosts file, Windows will then go to the Domain Name Server (DNS) to obtain the numerical web address. Its possible for a rogue program to change that file and force specified addresses off to a rogue server. So, at this point its worth looking at that file to determine if its been corrupted in any fashion and if so, to reset it back to the original contents.
http://www.thewindowsclub.com/hosts-file-in-windows
http://www.thewindowsclub.com/how-to-set-the-windows-7-hosts-file-back-to-default
When that Hosts file inspection/modification is complete and you are satisfied that any malicious program has been removed, reboot the pc or laptop. At this point, in theory, your pc or laptop should be clean and your DNS should be running correctly. For security purposes you should be running in a User account on your pc or laptop. If you don't normally do this, you should set up a User account that is used for daily purposes. With Windows 10 you can add an account for someone that you don't have a Microsoft address for, and set it up as a local pc account only, with or without password. A user account has fewer computer admin privileges , so if a rogue application tried to make any changes to your pc or laptop, there is a lesser probability that the changes would be carried out. It may not provide a 100% guarantee, but it will reduce the probabilities. If you used this pc or laptop for financial purposes or on sites that require a password you should strongly consider the possibility that your passwords have been compromised and that they should be changed. Remember, this is just me thinking of the worst case scenario. Everyone has to make their own choices. That should be done on a pc or laptop that you know is clean or by calling into the institution.
14. If you use Firefox, consider loading an Add-on titled FlagFox. It will display a country flag on the right hand side of the address bar so that you can see where the actual site is located. Using a right click on the flag also brings up other options that you can use.
Hope this helps. Definitely a long answer to what appears to be a simple issue. Using a Russian DNS would slow down the page loading as the the DNS request has to travel to Russia and back before the browser or application has the address that it needs to navigate to the site that you have requested.
In terms of the connection issues, are you seeing this on a wifi or ethernet connection? Can you read thru my posts #14 and #16 on the following page regarding the Downstream and Upstream tables, inSSIDer, and Pingplotter and post in the same data that I indicated in those posts. With that info we can address the connection issues:
http://communityforums.rogers.com/t5/forums/forumtopicpage/board-id/Getting_connected/thread-id/3489...
Ok, it looks like you're several steps ahead of me, and this problem still exists. Rather frustrating I would say. Ok, so the question at this point is: are you deliberately running several Domain Name Servers either thru the modem or pc settings? The reason that I'm wondering is the list of DNS Servers from your last post:
DNS Servers . . . . . . . . . . . : 2607:fea8:de0:624:f2f2:49ff:fe40:6bf2
193.0.201.201
98.158.96.96
91.109.206.194
62.152.34.29
The top one should be Rogers DNS, not sure of the rest as I don't have time at the moment to analyze what address belongs to whom. In any event thats very strange to see that.
If you restart the modem and check that list immediately following the IP address gain by the pc or laptop, is that list the same, or is it a much smaller list? I'm wondering how that list develops, by some malware running in the background, or by data errors creeping into the list?
I'll go thru that list using whois, just don't have time at the moment.
Edit; how does that list compare to one from an ethernet connected pc? Are they the same? They should be, considering that the modem is supplying the DNS addresses, unless of course you are using additional DNS addresses in different devices. If they are the same, and you aren't adding them, that points to a problem with the modem, specifically with UPNP and the DNS data. Possible bug?? Maybe the UPNP is still running even though its indicated as Disabled?
Is your wifi adapter running on a 2.4 or 5 Ghz network?
-
12778 views
-
2 Likes
-
-
