How to run a router virus scan and remove malware

Router viruses don’t just slow your internet; they can hijack your traffic, redirect you to unsafe sites, and let other malware take over your devices. For example, TheMoon virus infected over 40,000 routers and smart devices across 88 countries, allowing cybercriminals to use these networks and hide criminal activities.

The good news is that you can run a quick router health check to catch router malware. Read on to learn how to spot router malware, how to do a simple router check, and ways to help protect your router.

Can a router get a virus?

Viruses and other malware can infect routers by exploiting firmware vulnerabilities and web-admin flaws. Router firmware, the built-in software that runs it, is often easier to exploit if it’s outdated.

For example, the VPNFilter botnet malware exploited firmware vulnerabilities in over half a million routers until the FBI seized control of it on May 23, 2018. VPNFilter targeted routers to collect data, potentially leaving them inoperable.

Hackers can also target routers with brute force attacks to guess admin passwords. Once inside, criminals can change DNS or other settings to redirect you to unsafe websites where your device could become infected with computer worms or other malware.

How to know if your router has a virus

Your router may have a virus if you notice persistent issues or unusual behavior on multiple devices throughout your home network. Common red flags include losing access to your router’s admin dashboard, unexplained changes to settings, redirects to other web pages, or frequent connection drops.

Look for these signs to help spot a router virus:

• Admin page issues: Viruses may lock you out by changing your admin username and password, wireless network name, or router’s IP address.
• Changed settings: Malware may alter your Universal Plug and Play (UPnP) settings, which can automatically open online gaming ports to allow malware to sneak onto your devices.
• Unusual activity: Strange activity in your router’s activity log includes large outbound connections, spikes during late hours, or repeated communication with unfamiliar IPs you don’t normally access.
• Overheating router: Sudden overheating can be a symptom of malicious or abnormal activity.
• Redirected web traffic: If multiple devices and browsers redirect you to different URLs and spoofed pages, your router’s DNS settings may be hijacked.
• Frequent connection drops: Repeated, unexplained connection drops can indicate unstable firmware due to a hacked router.
• Unknown devices on the network: Look for devices you don’t recognize. In some cases, attackers use a wardriving attack to locate networks and exploit router vulnerabilities.

How to check your router for a virus

You can check if your router has a virus by logging in, checking the activity logs for suspicious behavior, and reviewing its security settings for any changes.

1. Log in to your router

First, log in to your router to access your admin dashboard. This lets you review suspicious activity or changes that may signal an infected router. If you have a router management app and can review activity logs and changes there, you can skip to the next step.

Here’s how to log in to your router:

1. Find the router’s local IP on the label (often 192.168.0.1 or 192.168.1.1).
2. Find your admin username and password (network security key) in your owner’s manual or on the router.
3. Type the router IP into your browser’s address bar.
4. Enter your router’s login credentials to access the admin dashboard.

If the credentials fail, someone may have changed them. In this case, jump to our steps on what to do if your router has a virus.

2. Review your router’s activity logs and devices

Your router’s activity logs can reveal newly added devices or traffic spikes that could be suspicious. Look for a general activity log, which may be located under parental controls or advanced settings. If you have a router management app, look through its menus to find this information.

Here are some signs that you might have a virus:

• Unknown devices: Unknown devices may belong to nearby intruders, like a neighbor or passerby. This could indicate someone has intentionally gained unauthorized access to your network.
• Repeated failed logins: Multiple incorrect password attempts in the log may point to a brute force attack.
• Strange traffic spikes: High outbound traffic or activity when nobody in your home is using your home network could mean the router is infected with a virus or another type of malware.

3. Check your router’s settings

Double-check your router’s settings, including your Wi-Fi name, admin credentials, and remote access settings. Unexpected changes may mean your router is compromised.

Here are some suspicious changes to look for in your router:

• DNS settings: Changes to your Domain Name System (DNS) entries can redirect your network traffic to fake login pages that harvest your credentials.
• Port forwarding: Viruses can change port forwarding rules to create hidden backdoors, providing hackers with an easy attack vector into your home network.
• UPnP (Universal Plug and Play): Hackers can enable UPnP to open unnecessary ports to sneak malware past your firewall.
• Remote access: Changes to remote access settings can let hackers control your home devices to steal sensitive information.
• Device access lists: A modified device blacklist or whitelist may remove your own devices or add an attacker’s, granting them easy access to your network.
• Guest networks: Malware could create a new guest Wi-Fi network you didn’t set up, providing nearby attackers with an open entry point.

What to do if your router has a virus

If your router has a virus, immediately disconnect from the internet and perform a factory reset on your router. Then, secure your router with a new, strong password. Once you reconnect, update your firmware.

Here’s a step-by-step guide detailing what to do if your router has a virus:

1. Disconnect from the internet: Unplug your router from the power source to disconnect from the Internet. A physical disconnection prevents malware from sending your data to cybercriminals.
2. Perform a factory reset: Hold the recessed reset button on your router for around 30 seconds to restore factory settings. This removes malware infections in your firmware.
3. Change your admin credentials: With your router still offline, set a new admin username and a strong, unique password in the router’s dashboard.
4. Use stronger encryption: Still in your router’s settings, change your encryption to WPA2 or WPA3. Stick to these stronger encryption methods and avoid weak security protocols like WPA or WEP.
5. Scan all connected devices: Run a full antivirus scan across all your devices to remove any malware. Continue to monitor devices for unusual behavior, such as website redirections, pop-ups, or system crashes that may signal a lingering infection.
6. Reconnect and secure your router: Reconnect your router and immediately update your firmware. Then, disable unsecure features you don’t use, like remote management and UPnP, to reduce your attack surface.

How to protect your router from viruses before they happen

Protect your router from viruses by changing default passwords, using WPA2 or WPA3 encryption, and regularly updating your router’s firmware. You should also take steps to protect the devices connected to your home network by keeping software updated and using a trusted antivirus.

Here are some steps you can take to defend your router against viruses:

• Keep firmware updated: Update your router’s firmware periodically to help avoid vulnerabilities in outdated firmware. If your router supports it, enable automatic updates from your router’s settings.
• Turn off WPS: Disable Wi-Fi Protected Setup (WPS) on your router, as it has known security flaws. WPS is typically a button found on the front of  routers.
• Activate your firewall: In your router’s security settings, ensure your firewall is active to help block unsolicited or unrecognized connections.
• Disable remote management: Turn off remote management (sometimes listed under WAN or security settings) unless you absolutely need it. If you must use it, make sure it’s restricted to one device and protect it with a strong password.
• Limit UPnP: Disable UPnP when you’re not using it. UPnP automatically opens ports for certain applications, which malware can exploit. Enable it only when necessary, such as when troubleshooting online games, and turn it off again afterward.
• Disable port forwarding: Close forwarded ports from your security settings to help prevent hackers from sneaking malware past your firewall. If you need to open ports, limit them to one device and close them once you’re done.
• Isolate IoT devices: Create a guest network to isolate your IoT devices from your main network, as they can be more vulnerable to attack.
• Defend your devices: Protect your devices by keeping software updated and using a reliable antivirus. Regular scans can help you spot hidden threats like Trojans before they spread across devices on your home network.

Protect devices on your home network

Home network protection involves securing your devices and your router. Norton AntiVirus Plus helps secure your connected devices with award-winning antivirus, AI-powered scam detection, and hacking protection. Get it today to cover up to five devices on one subscription.

FAQs

How do I know if my home network is infected?

Some signs your home network is infected include unexpected activity or connected devices, changes to your router’s settings, and if your antivirus software spots malware on multiple devices.

How often should I scan my Wi-Fi for malware?

You should review your Wi-Fi network for vulnerabilities at least once every six months. Open your router’s admin settings and look for any suspicious activity, changes, or devices. You should scan connected devices at least once a week.

Can I use my computer’s antivirus to scan my router?

Few antivirus programs scan routers directly, but most router viruses can be removed by factory resetting your router. If your antivirus detects malware on multiple devices, it could indicate that there’s malware on your router.

Can viruses spread through Wi-Fi?

Viruses can spread through a Wi-Fi network. Malware can spread from one infected device to others on the same network, or the infection can start at the router level.

Can a modem get a virus?

Modems can get viruses when criminals exploit outdated firmware. You should allow automatic firmware updates, or manually check for updates at least every six months.