How to Check for Router Malware (and Remove Viruses)

When they operate normally, routers go unnoticed while keeping us connected to the internet. Unfortunately, this means we often forget to make sure they’re secure, so they may become vulnerable to router malware and other threats. 

As the gateway to your entire network, an infected router can put all your online activity at risk. When this happens, attackers may hijack your router to steal your data, mine crypto, or use it in criminal activity.

Though it’s impossible for this guide to cover every conceivable scenario, we’ll cover the most common warning signs of a router virus and the most effective ways to deal with one. 

Can a Router Get a Virus?

The short answer is yes. Malware can infect any device that runs on some kind of firmware or operating system (OS). Because routers are always connected to the internet, they’re especially exposed.

Attackers often attempt to infiltrate a network through the router. Some of the easiest ways to compromise routers are by exploiting default or weak passwords, unpatched firmware vulnerabilities, or improper security settings.

VPNFilter is one of the most infamous examples of router malware. According to Cisco’s Talos team, this virus spread through an estimated 500,000 devices in over 50 countries over years.¹ It carried out attacks ranging from collecting sensitive information, like website logins, to orchestrating complex cyberattacks. It could even make routers unusable.

To combat it, Cisco Talos shared detection methods, blocklisted domains, and coordinated with at least five major router manufacturers as well as with the Cyber Threat Alliance. 

As recently as 2024, researchers found that the malware Chalubo targeted roughly 600,000 routers from a single internet service provider (ISP) back in 2023.² The routers became inoperable, disrupting internet access for many small office/home office (SOHO) users. 

What Can Router Malware Do?

Attackers often target routers because they act as the central hub for many networks. Compromising a router could allow them to spread attacks to connected devices, monitor network activity, or redirect traffic.

Is it bad if something infects your router? Well… yes. The least harmful thing that could happen is that someone hacks your router for free internet. However, other common dangers associated with router or modem viruses include:

• • Data theft: Attackers can abuse router infections to intercept network traffic and steal users’ data. Through so-called man-in-the-middle (MITM) attacks, they could harvest account logins, hijack sessions, or capture data packets transmitted between your devices and the internet.
  • Traffic manipulation: Through Domain Name System (DNS) tampering, scammers may redirect your connections from legitimate websites to phishing pages. They can also inject malicious ads into the web pages you visit or disrupt your browsing experience.
  • Malicious proxy activity: Malware could recruit your router to a botnet, allowing cybercriminals to abuse it for other purposes. This can include launching Distributed Denial of service (DDoS) attacks, relaying spam, or routing malicious internet traffic through your connection.
  • Local network exposure: An infected router gives the attacker the same access as someone on your local network. This exposes every locally accessible service, such as file shares, smart home devices, and network storage. From there, the attacker can spread malware to your connected devices, monitor traffic, or launch further attacks. This may result in privacy breaches, account takeovers, or other forms of cybercrime.
  • Loss of router access: Attackers may log you out of your router by changing its password or configuration settings. Some may even temporarily or permanently brick your device, cutting off access to the internet or other network devices.

Router Virus Symptoms: How to Tell Your Router Isn’t Well

Router malware will usually change how your router behaves, causing it to act in strange or unexpected ways. 

Here are some of the most common signs that your router might have malware:

• • Slower-than-usual internet: Many things can slow down your internet speed and malware is one possibility. In some cases, router malware could interrupt internet access or cause connectivity errors.
  • Website redirects: Your browser may open web pages you didn’t ask for or route you to a different site. Some of these sites may be obvious scams, while others mimic legitimate sites. The most obvious giveaway will be any unexplained changes to the original URL (for example, go0gle.com instead of google.com).
  • Device malware: You may discover malware on your device that originated from an infected router. Some of the most typical signs are weird or unfamiliar software programs, browser add-ons or toolbars, pop-up ads, persistent warnings or notifications, and other unexpected device behaviors.
  • Router access issues: You may struggle to access your router’s admin dashboard with the usual IP address or can’t log in with your credentials. Router viruses can even change the network name or other settings, making the router hard to find or manage.
  • Unusual network activity: Beyond the visible symptoms, malware could consume your bandwidth much faster than usual. You may also discover unusual activity in your router’s logs, such as many outbound connections, traffic spikes at odd hours, or repeated communication with unfamiliar IPs.
  • Weird router behavior: Malware may cause your router to switch on or off, change modes, drop connections, overheat, or do other surprising things. One possible visual sign is if your router’s indicator lights flash in ways they’re not supposed to.

Many of the same symptoms can also stem from issues with your device. A good way to tell whether your router is the problem is if the issues affect all devices connected to it.

Slow performance or timeouts often clear up after a restart. Turn off your router and unplug it from its power source for a few minutes before turning it back on. If the issue persists, it could point to a router virus.

How to Check Your Router for Malware

It can be difficult to know for sure whether a router virus is to blame for your network issues. Device malware, router hardware or software issues, or problems with your ISP can have similar effects. It’s also harder to investigate router troubles because routers don’t have conventional OS or consumer antivirus tools.

Still, you can use the following guides to narrow down the causes. If the issue lies with your router, some of the fixes are similar whether malware or something else triggered it.

Access Your Router

Start by checking whether you can still reach your router dashboard and if any settings changed without your knowledge. Some modern routers come with management apps that make this much easier. You can also access the router’s admin panel through your browser by following these steps:

1. On Windows, run the Command Prompt as an Administrator.

2. Type in “ipconfig” and press Enter.

3. Wait for it to complete and copy the IP address next to “Default Gateway.”

4. Paste the IP into your browser’s address bar and it should take you to your router’s login page. Some routers also use IPs like 192.168.0.1, 192.168.1.1, or 10.0.0.1 by default.

5. Enter your username and password. If you don’t know it or haven’t changed it, try the default “admin” and “password” or “admin” for both.

Check Your Router Settings

Once you’re in your router admin panel, you can start diagnosing the issue. Router interfaces and logging practices can differ significantly depending on the exact brand and model, so the guide below may not apply exactly. If you struggle to find what you’re looking for, check the user manual or support website.

Look for menu or navigation options such as “System Log,” “Logs,” “Security,” “Administration,” or “Maintenance.” Explore the available options to check all the following:

• • Unknown devices: Look for a Connected Devices or Device List and see if there are any new or unfamiliar devices.
  • Failed logins: Check the activity logs for multiple attempts to log into the admin panel or connect to the network, especially if they happen at one point in time.
  • Unusual traffic: Try to identify whether there was a significant and sudden change in network activity or bandwidth consumption.
  • Configuration changes: Review settings like registered administrator accounts, DNS entries, remote management, Universal Plug and Play (UPnP), and port forwarding rules for changes you didn’t make.
  • Guest network: Look for any registered guest networks on your router that you didn’t approve.

Depending on your familiarity with router setups, you may not be able to tell if anything is amiss. We only recommend adjusting configuration settings if you know what you’re doing. Otherwise, you may make the issue worse, weaken your router’s security, or cause it to not function properly.

What to Do If You Suspect Router Malware

If you suspect router malware, act immediately. Any delay may also give the attacker an opportunity to spread through your network. Start by closing suspicious websites and avoid entering sensitive information or logging into important accounts until you’ve resolved it.

You’ll need a good antivirus. Run a full malware cleanup on all your devices, especially if they show signs of infection. We don’t advise getting rid of a router virus with a compromised PC or smartphone. Even if an infection did spread from your router to your device, you still need to clean both separately.

Some security suites also include network or router inspection features that can help identify suspicious activity. However, they generally can’t scan or remove malware from a router in the same way that an antivirus can clean an infected computer. You’ll still need to inspect your router and follow recovery steps.

How to Remove Malware from Your Router

A factory reset is a common starting point for removing router malware, but it isn’t always enough. If malware has also compromised the firmware, the reset state might be too. This means the same vulnerability can allow reinfection once the router reconnects.

If your ISP issued the router, contact them directly. They’ll typically replace it and investigate. If you bought the router yourself, download the latest clean firmware from the manufacturer and install it before reconnecting to the internet. In either case, change the router’s username and password.

Check your router’s manual for model-specific setup instructions and default login credentials, which you’ll need once you do a factory reset. A typical reset and reconfiguration process looks like this:

1. Find the reset button: This is usually a small, recessed button at the back of your router. Depending on the model, you may be able to press it with your finger or may need something small and sharp like a paperclip.
2. Reset the router: Keep the router on. Press and hold the reset button for 10 to 30 seconds (or as your manual prescribes).
3. Wait for the router to restart: You may see the power lights turn off and back on or start to flash as the router reboots. This may take anywhere from thirty seconds to over a minute.
4. Reconfigure basic security: Set a new admin username and password as soon as you’re able. Check for and install the latest firmware update before you reconnect to the internet and restore your usual settings.

Protect Your Router Against Malware and Viruses

The best cure is prevention. Here are some practical precautions you can take to help protect your router against malware.

1. Upgrade your password: Strong passwords are the first line of defense against many types of threats, including man-in-the-middle attacks. Choose something complex, hard to guess, and save it somewhere safe, like a password vault. If you already have a strong password, installing a VPN on your router is the next best security measure.
2. Update the firmware: Outdated or unpatched firmware is one of the most common router vulnerabilities. Check the manufacturer’s website for any available patches and apply them. Your model may also support automatic updates.
3. Scan your devices: Run scans often using a trusted network inspection or security tool.
4. Upgrade the hardware: Upgrading to a router that has built-in security features can help protect your network from outside threats.
5. Check the DNS settings: You can also take a brief look at your router’s DNS settings. Unless your network administrator has configured them differently, the DNS should be set to dynamic, which means your ISP handles everything.
6. Disable remote management: This is one way attackers can access your router from outside your network. Unless you often connect to your home network remotely, turn it off (usually under the wide area network (WAN) settings). If you do need to use it, make sure to allow only trusted devices or IPs.
7. Use secure settings: Turn off unnecessary features that could lead to compromise. For example, disable Wi-Fi Protected Setup (WPS), UPnP, and unused port forwarding.

Keep Your Network and Router Safer

The router is often the heart of your network, so it’s worth taking the time to make sure it’s not vulnerable. Prevention is key and some security good habits, like using strong passwords, updating firmware, and conducting regular malware scans on all your devices, can go a long way to keep your router safer. If you suspect a problem, a factory reset may resolve some configuration issues. 

While a VPN doesn’t remove or prevent router malware, running CyberGhost VPN on your compatible router encrypts your network traffic and adds a layer of security between your devices and the VPN server. Try it risk-free with our 45-day money-back guarantee (14 days on monthly plans).

FAQ

References:

1. New VPNFilter malware targets at least 500K networking devices worldwide — Cisco
2. Mystery malware destroys 600,000 routers from a single ISP during 72-hour span — Ars Technica