Member Avatar for RikTelner

Something is connected to my Wi-Fi without my permission.
I don't know what/who this is.

How do I get rid of? Is it hacker/virus?
I should be only one listed.

Edited by RikTelner
  • 3 Contributors
  • 6 Replies
  • 270 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

The thread shows an unexpected client on a home Wi‑Fi and useful troubleshooting already from and ; reports the factory reset did not clear access and names an Experia Box (V8). That model (and many ISP-supplied gateways) can behave differently from retail routers: providers often have their own provisioning, a specific reset/service-tool flow, and a reset can require a long wait or remote re-provisioning rather than a simple immediate unlock. (kpn.com)

A practical next step is to identify the mystery client from inside the LAN before assuming a virus/hacker. Use a local scanner (mobile: Fing; desktop: ARP and Nmap) to collect IP, hostname, MAC and any open ports, then do an OUI/MAC-vendor lookup to infer the device maker or type. Example quick commands:

arp -a
sudo nmap -sn 192.168.1.0/24

Note that modern phones may use randomized MACs, so identification can be ambiguous. (help.fing.com)

If the device cannot be removed because router admin is inaccessible after a reset, the ISP support path is often required: use the provider’s service/reset tool or request replacement/re-provisioning of the Experia Box. As an alternative, putting a user-controlled router or AP behind the ISP gateway (bridge/DMZ or equivalent) returns full Wi‑Fi control to the household hardware. (kpn.com)

Finally, check WPS status: the WPS PIN method has a documented brute‑force weakness and should be disabled or patched where possible; if the ISP-managed box cannot be changed, request that the ISP disable WPS or swap the unit. If the unknown client looks hostile, isolate the network, document DHCP/ARP logs from scans, and insist on hardware replacement. (cisa.gov)

Recommended Answers

All 6 Replies

Member Avatar for rubberman

Is your WiFi secured? If secured with WEP, change the security to WPA and select a strong passphrase. If not secure, change it to WPA and select a strong passphrase. If already WPA, change the passphrase to a strong one that is difficult to guess.

Also, go into your router web interface and disable remote access/monitoring, and change the admin password.

Finally, what is the make/model of your router/wifi-access-point?

commented: Good that you tried to answer. +2
Member Avatar for RikTelner

It is secured by WPA2-Personal totally random password.

I can't get in router web interface because I need password for it. And I'm teenager that lives with mother, and she claims there was no password. The user input is automaticly filled with Admin and I tried root, toor, admin, r00t, t00r, pwd, pass etc. .

Member Avatar for rubberman

Read the documentation for the router. You may be able to reset it to factory settings by pressing a recessed button for some period of time, then you can get in with default settings (possibly no password at all) and then reconfigure it to suit. You still didn't answer the question as to what is the make/model of the device. If I know that, I can help you better.

WPA-Personal is decent security, but the problem may be the remote admin capabilities most of these devices provide. That is a back door more and more frequently used by hackers to get access to your personal network. Once they have admin access to the router, then they can easily find out what the WPA password/passphrase may be, AND they can change the admin password so you can't get in to reconfigure the router, sigh... :-(

So, once you know how to do a factory hardware reset, disconnect it from the internet, reset to factory settings, login from your local machine (while connected via wired ethernet, not WiFi), and reconfigure the router to

  1. Disable remote administration services.
  2. Change admin password.
  3. Change the SSID and make it "invisible".
  4. Reset the WPA passphrase to something only you and your family may know.

After all this, reconnect to the internet, connect via WiFi, and verify that you can get to stuff like google.com, et al. Once that is working, reset other home WiFi devices (laptops, phones, tablets, etc) to access the new SSID with the new passphrase.

Yes, this is all a major PITA, but it is the ONLY way to secure your home network in a reasonable manner.

Edited by rubberman
Member Avatar for RikTelner

Reset doesn't work. It seems that my modem is called "experia box8" or something like that. So it's probably itself.

Member Avatar for gerbil

Do a hard reset while it is powered up. Wait for the lamps to flick off, then release the button.

Member Avatar for rubberman

Well, from what I can find, this seems to be a european router - most of the links I found in a Google search were in Dutch or were from South Africa. If you are in the USA or UK or Europe, try purchasing a different router/Wifi-AP. They aren't too expensive these days.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.