Open DNS Resolver

50Twuncle

kwikbreaks wrote: »

Sounds to me like you may have some malware running and although I'm certainly not the best to advise on that I'd suggest that you download and run MalwareBytes

What they are saying is that you have something running on your network that is acting as a DNS server which means you must have port 53 open to incoming requests on both the router and whatever machine the DNS software is running on which is very strange. I can only guess that the malware (assuming it is) has use UPnP to open the port. Disabling that on you router may stop it working.

I'm going to have a google as I've never heard o this sort of problem.

Does Malwarebytes free allow you to get rid of any nasties / do you need the paid for version to do this ?
I think that the free version may just detect ??

KiKi

Virgin were useless. They said I'd need to re-contract with them so they could provide me with a new router, which is now a superhub. And I'd have to increase my DIrect Debit by £4.50 a month. Plus £20 installment fee.

I asked how to fix the problem - they told me to refer to the letter. I told them there was no solution in the letter, and they said it wasn't their problem.

I refused a superhub; I'll try the Port 53 thing first, then just buy a new router if that fails.

Thanks everyone.
KiKi

kwikbreaks

50Twuncle wrote: »

Does Malwarebytes free allow you to get rid of any nasties / do you need the paid for version to do this ?
I think that the free version may just detect ??

Yes it will clean. The pro version runs like AV and offers realtime protection rather than after the event cleanup.

I'm not sure this is malware though it could be some duff piece of equipment but as I said the easiest way to open the router firewall is UPnP so I'd disable that for sure (in fact I always do anyway).

50Twuncle

kwikbreaks wrote: »

Yes it will clean. The pro version runs like AV and offers realtime protection rather than after the event cleanup.

I'm not sure this is malware though it could be some duff piece of equipment but as I said the easiest way to open the router firewall is UPnP so I'd disable that for sure (in fact I always do anyway).

I has a similar problem - ran malwarebytes which told me that my YOUTUBE DOWNLOADER was infected - so that's been cleaned away.....

KiKi

kwikbreaks wrote: »

Yes it will clean. The pro version runs like AV and offers realtime protection rather than after the event cleanup.

I'm not sure this is malware though it could be some duff piece of equipment but as I said the easiest way to open the router firewall is UPnP so I'd disable that for sure (in fact I always do anyway).

How do I do this, please?
KiKi

50Twuncle

KiKi wrote: »

How do I do this, please?
KiKi

Open your browser and go to your router (default 192.168.0.1 for netgear) - then go to the UPuP setting (wherever that is) and remove the tick from it)
What router do you have ?
I know that it is Virgin - but what model is it ?

KiKi

50Twuncle wrote: »

Open your browser and go to your router (default 192.168.0.1 for netgear) - then go to the UPuP setting (wherever that is) and remove the tick from it)
What router do you have ?
I know that it is Virgin - but what model is it ?

It wasn't provided by Virgin, I bought it myself. It's a Sitecom 54g turbo WLAN router. Does that help?! (It means nothing to me...!)

ETA - the UPNP box is unticked - it had never been ticked. I can't see anything else obvious there about how to block ports...

Thank you for your help
KiKi

KiKi

I can't see anywhere to block port 53 on here, and other internet forums suggest that it only solves the symptom, not the problem...?

Anyway, think I'll just buy a new router, if that will sort it out. Can anyone recommend a good router?

Thanks again
KiKi

securityguy

KiKi wrote: »

I can't see anywhere to block port 53 on here, and other internet forums suggest that it only solves the symptom, not the problem...?

No, it solves the problem, for all practical purposes.

Anyway, think I'll just buy a new router, if that will sort it out. Can anyone recommend a good router?
KiKi

I like Microtik stuff, but that might be a bit hardcore...

kwikbreaks

Routers by default will block all incoming ports where ther was no outstanding request from inside your network for a reply. You have to take positive action to open a port and direct it to some device of your choice - this is called port forwarding or sometimes port translation if you redirect some incoming port to a different port number.

If you have no port forwarding rule for port 53 (the port used for DNS requests by default) and UPnP is not enabled then I can only assume that your router may have some fault. See if you can find a new firmware for it and install that.

As I said in my initial post I've never heard of this problem before but it can't be all that rare or ISPs wouldn't be testing for it and TBB wouldn't have a page allowing you to test for it.