Router automatically changes SSID

[Shizzmoney]

Hey all,

I have a Arris TG3482G Router from Comcast (I know, awful) connected to an gigabit ethernet port (TP Link TL-SG105) that connects to my PC and various gaming devices (PS4, Raspberry Pi, XBOX360).

I recently went into my router's settings, and noticed a completely different SSID/Password than the one I setup as well as a ton of unauthorized devices.  I went onto a separate computer (NOT on my network, that has never touched my network) and changed all my passwords on my ISP's site just to be sure. 

Then, I was able to get in there, change the WiFi name/password through there, and indefinitely paused the unauthorized devices connected to my Wi-Fi, via the ISP's gateway, as well as blocking the MAC addresses I found via the WiFiWatcher application I have on my PC. 

I still can see the Wi-Fi name and password I setup on Comcast's page and connect; but in the router's Wi-Fi settings page, there is still the completely different SSID.  Additionally, I factory reset my router (password for the router and ANOTHER new SSID I setup) and within minutes, it goes back to the completely different SSID and the same password on the routers' "Private Wi-Fi Setup" page.  I was thankfully able to disable that name/login and I don't see it or the devices (they share a name) on my network running.  I also disabled WPS and set the Firewall Security Level to High.

I ran a full malware scan and was unable to find anything malicious; additionally, I have multi-factor authentication on all of my important sites I use, and have not ran across anyone trying to get into any of my important accounts (i.e. I still have my BTC haha). 

But obviously someone did something to either the router or did something on a program which Malware Bytes/other software can't find.  Can anyone help? FRST attached.  

 

FRST Router SSID.txt

[exile360]

Greetings,

You might be suffering from the same issue described in this topic.  It turned out to be an issue caused by the fact that the user's ISP never installed a MOCA filter on their connection which was causing their connection to 'overlap' with that of their neighbors', resulting in strange devices showing up on their network, connectivity issues, spotty service and tons of other problems that sound a lot like what you describe.

I would definitely advise contacting your ISP's support department as you will certainly require their assistance to track down and resolve this issue.

I hope this helps and if there is anything else we might assist you with please let us know.

Thanks

[David H. Lipman]

You may want to consider buying your own Router ( no rental fee ) so you have full control.

It is just a matter of choosing an approved, supported, Router and contacting Comcast and providing them the new device's Cable MAC ( aka CMAC ) address for MAC Approved access to their network.

https://www.xfinity.com/support/articles/list-of-approved-cable-modems

 

[Shizzmoney]

I just checked my line in from the main coax jack....there is no MoCa filter.

I can get signal from my Wi-Fi and hard wired and the gateway says my devices are connected...but I get booted out of my router page and sometimes I cant connect to 99% of websites all together.  I also think the users whos devices I blocked may have also blocked mine and now my internet doesn't work.  

Interference would be so consistent with the fact say if a new person just moved in...and Comcast came in and installed a line that was creating interference *or* the end user had a device like a Smart TV (which came up on my devices list) that was doing so.

I will try this.  I may also have them come here and try to get them to also check the main connection to see if that is also contributing to the issue.

[exile360]

Ah, that makes sense.  I bet that's what it is.  Hopefully you won't have to fight with your ISP to get them to install the filter for you (or at least provide one so that you may install it yourself) like the user in that thread did.  Their ISP just refused to take the blame until like the 3rd time one of their techs came out and flat out verified that there was no MOCA filter and that was the cause of all the issues.  As soon as the filter was installed all the problems vanished in an instant.  I hope it will be as simple in your case.

Don't get me wrong, it is entirely possible that someone malicious in your neighborhood is using hacking tools to infiltrate your network and change your settings, but based on your description of things it really doesn't sound like that's what is going on.  If it does turn out to be the filter, I bet your neighbor needs one as well, so hopefully your ISP will realize this and install them for everyone that doesn't have one in your area because every connection/customer is supposed to have one.

[Shizzmoney]

I definitely think its more MoCA filter related; I just ordered some off the web today to come tomorrow to see if it fixes the issue once I install it. 

I will also say that in reading the reviews for various MoCA filters online, people definitely were buying these for a very similar issue that I am having (which is comforting because this means the issue is more structural, i.e. interference, rather than a malicious attempt to hijack my network), especially with the Comcast X1/X3/X6 model modems (which I have).  I also think at my last apartment, I definitely had these installed onto the coax cable and I never had this issue.

  

[exile360]

Excellent, please let us know how it goes once you get the filters installed.  Hopefully that will eliminate the issues.

[Shizzmoney]

On 1/9/2020 at 2:22 AM, exile360 said:

Excellent, please let us know how it goes once you get the filters installed.  Hopefully that will eliminate the issues.

Hey ya'll... attached this to my router yesterday, and it WORKED!

I installed the MoCA Filter, hard reset my router, and re-setup my whole network.  Have not had any issues with randomness on my router's gateway as the random SSID/PW is now good, nor my WiFi devices connected list.  I also ran a speed test, and my connection is also a little bit faster for the trouble.

Thanks for the support and the suggestions!  You guys rock! 

[exile360]

Awesome, I'm glad that it was a success  

It seems this is a common issue lately; I guess these cable companies are getting cheap and/or lazy with regards to installing these filters because you are the third person in the past couple of months to be suffering from this issue, and the fact is that your ISP is supposed to install those filters on every connection that they deploy.

Anyway, I'm glad that it's fixed and that we were able to help.

If there is anything else we might assist you with please don't hesitate to let us know.

Thanks

[Shizzmoney]

I bet most don't even know...especially since that I am reading more and more than devices like smart TVs, TiVo, and USB sticks (like Kodi or Amazon Fire) that connect over coax can create interference with routers on similar networks, especially in apt buildings like mine.  

I would add this filter check should be added to any "WiFi security" bucket hardware SOPs, as well as in the IT community, as MoCA is becoming more standard for not just coax cable enhancement but also for end users who  buy MoCA adapters online to extend WiFi quality over medium-to-large areas.  I do know one reason the MoCA filter adapters run well for WiFi is that you can customize them to a certain frequency for different areas of the coverage area in a house (so, for example, when you are watching Hulu with the wife in the bedroom it doesn't slow down your kid playing Fortnite downstairs, and vice versa); I am sure on the macro this same reason is why they tend to cross swords when you have a bunch of different individual routers in a small space.