Redirected at login

[debjed]

When I try to login to www.routerlogin.net or www.routerlogin.com I am redirected to a different site at www.routerlogin.net:80.

A pop-up tells me that a password will be sent to me unencrypted.

In these days of security concerns, this looks suspicious - is it ??  or can I go ahead and use the pop-up ?

I want to get into the setup area to change my password.

Thanks for any help,

[debjed · Accepted solution]

OK,  Thanks very much indeed for your help.

[TheEther]

I wouldn't trust the pop-up.  In order to use www.routerlogin.net or www.routerlogin.com, you need to be directly connected to the router.  This can be through one of the router's Ethernet ports or one of the router's Wi-Fi networks.  Basically, the router needs to be in a position to intercept any DNS queries issued by your browser to either of those websites and respond with its own IP address.  If the query is not intercepted by the router, then it will go out to the Internet and hit Netgear's website and get back a generic web page, "You are not connected to your router...".  This most commonly occurs when your router is operating in AP Mode.

[debjed]

Hi, and thank you very much for your response, particularly the first sentence !

This could explain some funny stuff happening with e:mails being sent from our account so I think we have already been hacked, even though the antivirus scans (Avast) show nothing.

I have a Mac, connected to a Netgear D6200 modem by an ethernet cable and then it's by an ADSL line to the ISP so I thought I was "directly connected to the router".  Sorry to be slow at the computer jargon, but how can I change my setup to reach routerlogin.net ?

Or should I buy a new router from a different manufacturer so that I don't have to use the Netgear login ?

Thanks again for your response.

[TheEther]

By the looks of it, you are directly connected to the router.  You don't have to use routerlogin.net to connect to the router.  You can use the router's IP address.  If you open Network Preferences on your Mac and select the Ethernet interface, the router's address will be displayed.  Enter that address into your browser and you should be connected.

[debjed]

Thanks again, and for coming down to my language level !

I typed in the router's address 192.168.0.1 but it tried to redirect me again.

It came back with a pop-up saying  "To view this page, you must log in to 192.168.0.1:80.      Your password will be sent unencrypted."

[TheEther]

I fear that your computer has been hijacked. What URL does the browser show when you see that pop up?

[debjed]

Bugger !

I'm not particularly computer savvy, so please bear with me.  How do I find the URL of a pop-up (on a mac) ?  This is the pop-up :

When the pop-up appears, it is waiting for me to type in the "name" box.  I can't drag, copy or do anything with the pop-up except type in my name.  If I use the "cancel' button then the pop-up closes and it gives me this message (and I don't know how to get the URL of this either) :

401 Unauthorized 

Access to this resource is denied, your client has not supplied the correct authentication.

For info, these are the plug-ins installed on my mac - are they all liggit ?

Adobe Acrobat NPAPI Plug-in, Version 15.020.20042

Adobe® Acrobat® Plug-in for Web Browsers, Version 15.020.20042 — from file “AdobePDFViewerNPAPI.plugin”.

MIME Type Description Extensions

application/pdf	Acrobat Portable Document Format	pdf
application/vnd.adobe.pdf	Acrobat Portable Document Format (Interim)	pdf
application/vnd.adobe.pdfxml	Acrobat XML Portable Document Format	pdfxml
application/vnd.adobe.x-mars	Acrobat XML Portable Document Format (Interim)	mars
application/vnd.adobe.xdp+xml	XML Data Package	xdp
application/vnd.adobe.xfd+xml	FormFlow99 Data File	xfd
application/vnd.adobe.xfdf	Acrobat Forms Data Format in XML	xfdf
application/vnd.fdf	Acrobat Forms Data Format	fdf

MIG Contents Plugin

CIG Download — from file “EPPEX Plugin.plugin”.

MIME Type Description Extensions

application/x-eppex-plugin-1

SharePoint Browser Plug-in

Microsoft Office for Mac SharePoint Browser Plug-in — from file “SharePointBrowserPlugin.plugin”.

MIME Type Description Extensions

application/x-sharepoint	Microsoft Office for Mac SharePoint Browser Plug-in
application/x-sharepoint-protocolhandler	Microsoft Office for Mac Protocol Handler

Shockwave Flash

Shockwave Flash 22.0 r0 — from file “Flash Player.plugin”.

MIME Type Description Extensions

application/futuresplash	FutureSplash Player	spl
application/x-shockwave-flash	Shockwave Flash	swf

Zoom launcher - 3.0.1

zoom.us launcher plugin version 1.0 — from file “ZoomUsPlugIn.plugin”.

MIME Type Description Extensions

application/x-zoom-scriptable-plugin

zmp

[TheEther]

It takes a while for your picture to be approved by the moderators before we can see it.  In the meantime, those plugins look ok at first glance.

Can you try to log into your router using another device?  Another computer or smartphone, perhaps?

[debjed]

I get the same pop-up using a macbook linked to the router by wi-fi.

I think I'm OK from an ipad - the pop-up looks different and there's no mention of  ":80"

If I change the password to the router using the ipad, will that block my problem ?

I'm starting to think that the only way I am going to be sure this is behind me is if I buy a new router.  Or is the malware on my computer (and laptop) ?

Thanks again for your help - you're being very patient.

PS to anyone following this conversation :  let this be a lesson and change the username and password when you first install your router !!

[TheEther]

I'm still waiting to see the picture but I'm starting to think maybe you're OK. The pop-up you may be referring to could be the standard login for your username and password. The warning that your password will be sent unencrypted is not unexpected. It is due to the fact that Netgear routers use http instead of https for logging in.

Anyway, I will wait for the picture before I can say whether this is a false alarm.

[TheEther]

Ok, I see the picture.  Yeah, that's the normal login prompt.  Everything is ok.

[debjed · Accepted solution]

OK,  Thanks very much indeed for your help.