Someone hacking my router

[ThisIsntOM-]

Was wondering if anyone could help me regarding the following, have copy and pasted this from an email to VM so excuse it sounding very formal...

I am writing with regards to my home broadband and router issues.

A neighbour of ours has some bizarre obsession with hacking into our broadband router and setting it up as a modem or messing with the settings to enable them to benefit from our 200Kbs connection but also enabling them to view the websites we visit and also restrict access for us at times.

I would know this was happening because as we connected to our old router a strange log in window would pop up saying there has been connection issues and click this box to fix, it would then run through from 1 - 100% and then would allow us to connect to the broadband. This pop up is when he is interfering with our broadband connection.

I expressed my concerns to yourself and you sent us a new virgin media hub 3 however this one still has the same issue but diverts straight through to this “connections error” window and won’t allow us to connect unless we press “fix” but it does this every single time someone wants to connect or reconnect on a device.

I have included a screenshot of the above happening.

I believe that my neighbour is only able to do this by having the password to our WiFi but I am unable to login and change it due to this connections error window that constantly pops up.

At the time we was posted a new hub I signed up to another 18 month contract but currently we are unable to use the broadband without our neighbour interfering with our connection and using it for their own gain.

Are you able to send us another hub 3 which hopefully they won’t have the password to or advice how we can resolve this issue?

[SCA1972]

---

@chenks wrote:

photos won't show until approved.

---

Photos approved now.

______________________
Scott

Disclaimer - I don't work for Virgin Media. I'm just another VM user trying to help out.
My setup: V6 TV box, Vivid 200 Optical fibre with Hub 3 in modem mode connected to a Netgear R7000 router. Telewest/VM user since 2001.

[chenks]

---

@ThisIsntOM- wrote:

They gained access to the property when no one was home so that’s how they have the password and admin password.

---

are you saying they broke in?

[chenks]

---

@SCA1972 wrote:

---

@chenks wrote:

photos won't show until approved.

---

Photos approved now.

______________________
Scott

Disclaimer - I don't work for Virgin Media. I'm just another VM user trying to help out.
My setup: V6 TV box, Vivid 200 Optical fibre with Hub 3 in modem mode connected to a Netgear R7000 router. Telewest/VM user since 2001.

---

photos don't show any evidence of "hacking".

[jpeg1]

All you have to do is what you were told in the very first response on page 1.

Do a factory reset to the Hub, and immediately login to change the default admin password and WiFi password.  Use complex passwords and ones you have never used before.

Unless your 'hacker' is standing right behind you and looking over your shoulder they will not be able to get into your router.

Then you can stop wasting everyone's time with your imaginings.

[andybundy]

I've read through this 4 times, and apart from some problem causing the round "fix me" button, I see nothing showing any form of intrusion.

Suggestions:

1. Follow thr instructions given earlier.

2. Detail where the access denied message was found

3. You mentioned logging into a router. Did you mean the hub 3.0 as supplied, or another router in line without placing the hub into bridge mode? This would certainly cause the round box.

If 3 is right, remove the extra router. Also, check youve not configured any vpn or rdp software on your apple system.

As to the cause, I wonder whether either you have a signal problem Or when the latest hub was sent out, it did not get correctly configure.

Finally, there are many people who like to sound clever by telling you they can hack your computer. Most have no idea, and the rest are idiots. If you are still concerned, ask him what pc you have. Unless you have told him, he won't guess Apple.

Good luck, and stop worrying. 

[PinguThePenguin]

You can actually get a paper clip and find the reset button on your router and do it so everything resets to deafult then do 192.168.0.1 and change the passwords to something strong and keep your property locked in at all times. If you are 100% sure its them, contact the police as its against the law Computer Missue Act 1990. 

Any questions contact me.

[chenks]

why have you bumped a thread that was 3 months old?

[brucetownsend]

I have just experienced exactly the same problem. Internet connection dropped, a 'Connection problem' page appeared with a big red 'Click me' button. The URL was http://192.168.0.1:5422/?tool_troubleshoot&mid=Troubleshoot. There's no redirection for that IP address in my hosts file, it definitely appears to have been served up by the router.

I had changed the router admin password to something more secure than the default.

At the same time, a new wifi network AP_706906981 appeared in my list, which my phone somehow connected to automatically even though I've never used it. I don't know whether or not it was related, but the timing was suspicious.

I have anti-virus running on all devices, including the phone. Virus scan found no issues.

I'm sure we have not been broken into, we have a security camera inside, and we've not had any visitors outside the family.

Factory reset and admin password change seems to have resolved the problem, but it was a bit disturbing.

[andybundy]

As an earlier post suggested, let's park the paranoia. You seem concerned by the url you posted, but it is simply a separated app/script/whatever that listens on port 5422. I cannot understand  what you expect from your hosts file, especially as a direct IP connection is given.

As for the AP_ connection, I would suggest a neighbour was playing around and set up a public and open access point. Most mobiles are configured to connect to open services like that by default.

Hacking routers, whether locally or remotely offers little to a 'villain'. Trust me, as someone who was recently hacked by a real expert, you will not see it unless you know what to look for.

Good luck. Apologies for any typos, I'm limited to a mobile, while stuck in hospital.

[brucetownsend]

Andy, thanks for taking the trouble to reply. I really hope you get out of hospital soon 😞

I understand some of what you said. Any idea what the 'Click me' page might represent? Did it come from my router, or not? Is it a bona fide Virgin troubleshooting page (in which case, they couldn't have made it look more suspicious if they tried!)? Or something else? I don't think I'm paranoid, but it was a complete surprise and a bit concerning, and I'm also curious.