Trying to get on google but keep getting a page saying flash needs updating which in turn tries to get you to download a virus / malware? Do you have a TP-Link modem / router? Chances are your router has been hacked!

A customer of ours had this problem the other day, tried to get to google and kept getting this message in the browser to update flash pro. They  ignored the antivirus software’s warning and went ahead and downloaded the so called update. PC now infected! Many hours later after a clean install (just to make sure) we gave the customer their PC back.

When they returned home, plugged in, turned on, same message again when trying google! Didn’t matter which browser they used, always the same. All other sites worked fine apart from google. I got them to try on their other pc and smartphone, same thing. So this made me think it must be some kind of routing issue with the router. Turns out that their TP-Link router is pretty easy to hack and had been.

Here’s a link to a video on how to hack the router in question http://www.youtube.com/watch?v=wy4n8a3dy0Q

In short their routers DNS was changed from  8.8.8.8 to 50.63.128.135 This meant that when they try to get google the request was going to a dodgy server dishing out this fake flash player.

As yet I don’t think there is a firmware fix for this and a number of TP-Link routers may be affected. However you can protect yourself by blocking any external access to the router by enabling SPI which can be found under the Advanced Setup > Firewall section.

After more digging I found a few more people who have had this issue… http://www.bleepingcomputer.com/forums/t/526812/help-google-redirects-to-a-fake-flash-player-update-on-both-pc-and-mobile/page-3