NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

sparky99kms's avatar
sparky99kms
Initiate
Aug 30, 2016

C3700 Router Hacked - unauthorized connection

I have the security setup so that wireless access is restricted based on MAC address thinking this is the best way to ensure my ability to control access.  A very viscous virus/attack overtook a laptop connected to the network through a wireless connection. This virus has morphed itself to connect to the wireless router by masking itself to authorized unconnected MAC address and now connecting as a "wired" connection as "ready share internal". I do not have readyshare turned on (no boxes checked) and cannot delete a wired connection. There is no way for me to remove this unauthorized connection. Even if I do a factory reset, the reading I have done implies that it is likely the virus has now installed some sort of behind the scenes connection that occurs regardless of the router settings at start up of my wired computer that was virus free... apparently not so anymore. It is now using a static MAC address that does not exist in the authorized MAC addresses. I tried to enter the MAC address in the addresses to block and I receive a message that says it is duplicate address and I cannot block it. I have tried a factory reset multiple times and it immediately connects when the reset if finished, changes settings I have made, blockes addresses I have granted access, gives itself administrative priveledges on my machine and then makes shadow copies to send somewhere each night, changes the registry, etc. I can't figure out how to stop it. No virus software locates it. I emailed security at netgear and they told me to fill out some form that I cannot locate and don't really have time to wait for a fix... but will if I have to. anyone else have this problem? I am running Windows 7

 

Thanks

Kristina

Security
Troubleshooting

4 Replies

    • DarrenM's avatar
      DarrenM
      Sr. NETGEAR Moderator
      May 04, 2017

      Hello Halemom

       

      If you feel someone else is on the network Id suggest changing your wireless passwords or even factory resetting the modem and setting it back up with all new passwords.

       

      DarrenM

      • Halemom's avatar
        Halemom
        Aspirant
        May 05, 2017

        Thanks for the response! Believe me I have changed all my passwords, I've called my ISP, and yet it still is happening. At this point I feel the only option is to buy another router and take my previously connected devices to a repair shop to see if the virus has infected them too before connecting a new router/modem combo and re corrupts my entire system.  I'm disappointed that my product was sold with an exploitable security risk. They never contacted me about this risk or offered a support despite the fact that they had my customer registration information so that they could tell me that I was no longer eligible for support. It seems that Netgear's equipment is only viable for a short time.