Router Hijack? Wonderlandads pop-ups/redirect on multiple devices

[Higurashi]

Hello,

I first noticed this 3-4 days ago, but I seem to get persistent pop-ups/redirects on my android chrome browser (Asus Padfone S). Every time I browse something on chrome a new tab would randomly open to wonderlandads.com/afu.php?zoneid=437742, which after a few seconds would then redirect to one of several online shopping websites I have never used before. After a few futile attempts at removal (including but not limited to clearing caches and factory reset) I noticed that these redirects only happens when it's connected to home network.

I tried to browse for similar issues and a lot of people have been saying that this malware infects DNS router, which left me wondered why my laptop (ASUS A46C, Windows 7 with Microsoft Security Essentials) was spared from similar symptoms, before I realized that I have adblockplus turned on. Adblockplus appears to prevent new tabs from opening (new tab DOES open up, before automatically closed by adblock). Turning it off produces the symptoms I had on android.

This doesn't happen with other browsers (Puffin on android have no issues even when connected to home network, no redirects with Firefox and IE on laptop). In android new tabs would open every few taps, while the trigger on laptop seems to be left/right mouse clicks. Also turning Java-script off on chrome prevents new tabs from opening up in android phone.

What I've tried so far:
1. Reset Chrome to default settings

2. Reset my router to factory settings and changed its password

3. Scanned my laptop with AdwCleaner 6.040, detected several issues but removal didn't prevent pop-ups/redirects from happening

4. Scanned my laptop with Malwarebytes, no issues detected

Some people suggested that I upgrade my router firmware but I think the option is disabled by my ISP. There are two other laptops connected to home network, but unfortunately I have no access to them currently, so I can't say for sure if these other two laptops have the same issue or not.

I would appreciate any help with this issue. Thanks.

 

Putra (Indonesia)

[Higurashi]

UPDATE:

Sorry for the double post, but it appears that a lot of this particular ISP users are complaining about similar issues. First known issues dated from 4 days ago (when I first noticed the issue on my android).

[Utomo]

I also got worderads problems. and still no solution yet

[MichaelHioe]

I had the same problem here.. Are you using indihome?

[mongkipembawa]

Yes, i also had the same problem here, wonderlandads almost directing any link to random ads, the problem is from indohome i thougt. Any suggestion?

[rich8606]

Same here, started happening 2 days ago. Redirects to:

- wonderlandads.com/afu.php?zoneid=437742

- www.gocloudly.com/goac/index.html?

- www.maxonclick.com/a/display.php?r=1033103

 

Only happens on my Telkomsel Speedy connection, all my connected are affected simultaneously:

- Win 7 laptop (Chrome and Firefox browsers)

- Win XP desktop (Firefox)

- Xperia Z5 (Chrome and Dolphin browsers)

- Samsung Galaxy S5 (Chrome and Samsung default browsers)

 

Based on several forums' suggestions I've read, this might be a tempered router DNS problem or an adware problem. So I did:

- Scanned both laptop and desktop with Malwarebytes Anti-Malware, no problem detected.

- Scanned both laptop and desktop with Adwcleaner, found and deleted several adwares.

- Forced stopped all browsers on both phones, cleared browsers' cache and data, and restarted phones.

- Reset my router to factory setting and updated the firmware

Problem seemed to go away at first, but apparently it still persists, though weirdly it happens less frequently on my laptop and desktop now, still happens everytime on my Xperia phone though. I checked with Telkomsel, the router DNS are not tempered, both are set to secure Telkomsel DNS.

 

I'm outta ideas, anybody here has any solution to this?