How to check your home Wi-Fi network for viruses and malware yourself

Has your home Wi-Fi suddenly started to slow down, and are your devices connecting to the network with delays? The problem may not be with your ISP, but with viruses or malware, which has penetrated your local network. Attackers often exploit router vulnerabilities to spread botnets, mine cryptocurrency, or intercept personal data. According to statistics, Kaspersky, in 2026 Every fifth home router in Russia showed signs of malware infection., and 68% of users didn’t even know about it.

Checking Wi-Fi for viruses involves more than just scanning individual devices, but also a comprehensive analysis of traffic, router settings, and network activity. In this article, we'll cover 7 working methods, which will help identify threats: from basic diagnostics through the router's web interface to advanced tools like Wireshark And GlassWireYou'll learn how to recognize signs of infection, which router settings to check first, and what to do if a virus has already penetrated your network.

Signs of an infected Wi-Fi network: When to sound the alarm

The first step is to determine if there is cause for concern. Wi-Fi viruses rarely show obvious symptoms, but there are indirect signs, which should be a warning sign:

• 🔌 A sharp drop in internet speed Without changing the plan. For example, with a 300 Mbps plan, the actual speed never rises above 50 Mbps, even though the provider is not experiencing any issues.
• 📱 Unknown devices connect spontaneouslyGadgets with unfamiliar names appear in the router's client list (for example, android_1a2b3c or esp_8266).
• 🔄 Frequent router reboots or resetting the settings. If the router reboots every 10-15 minutes without your intervention, this could be a sign of a botnet.
• 💻 Browser ads or redirects on all devices in the network. For example, when opening vk.com You are redirected to a site with a suspicious domain.
• 📡 Network activity during non-working hoursThe data transfer indicators on the router blink at night when all devices are turned off.

One of these symptoms alone doesn't necessarily mean your Wi-Fi is infected, but a combination of them is a reason to conduct a thorough investigation. For example, if an unknown device connects to the network And the speed has dropped by 3 times, the probability of the virus is ~80%.

⚠️ Attention: Some symptoms (such as low speed) may be caused by congestion on your ISP's network. Before running a virus scan, make sure the problem isn't with your ISP—call support or use a service. Speedtest on another device (for example, via mobile Internet).

Method 1: Check the list of connected devices in the router

The easiest way to identify suspicious activity is to view the list of devices connected to your network. To do this:

1. Open your router's web interface. The address typically looks like this: 192.168.0.1 or 192.168.1.1 (check the sticker on the device body).
2. Enter your login and password (by default it is often admin/admin or admin/password).
3. Find the section DHCP Clients, Connected Devices or Local area network (the name depends on the router model).

The list will show all gadgets that are currently or have recently been online. Pay attention to:

• 🆔 Unknown MAC addressesEach device is assigned a unique MAC (for example, 00:1A:2B:3C:4D:5E). If you see an address that doesn't belong to your devices, this is cause for concern.
• 🕒 Connection timeIf your device is active at night or when you're away, it may have been hacked.
• 📶 Unusual namesViruses often disguise themselves as legitimate devices (e.g. iPhone_12_pro, although you don't have it).

To identify "your" devices, compare the MAC addresses listed on the router with those of your gadgets. You can find the MAC addresses:

• On Windows: run the command

  ipconfig /all

  V CMD and find the line Physical address.
• On Android: go to Settings → About phone → General information → Wi-Fi MAC address.
• On iOS: Settings → General → About → Wi-Fi Address.

⚠️ Attention: Attackers can spoof a MAC address to match your device's address. If in doubt, disconnect all your devices from the network and check whether any "unnecessary" devices remain in the router's list.

Disable it via the router's web interface|Change the Wi-Fi password|Enable MAC address filtering|Update the router's firmware-->

Method 2: Analyze network traffic using Wireshark

If the list of connected devices is clean, but suspicions remain, move on to traffic analysis. Wireshark — is a professional network activity monitoring tool that helps identify:

• 🕵️ Suspicious connections to external servers (for example, in China, Russia or the Netherlands, if you haven't visited them).
• 🤖 Botnet activity (mass requests to the same IP addresses).
• 📤 Unauthorized transfer of data (for example, sending files to unknown servers).

To scan traffic:

1. Download Wireshark With official website (only for Windows/macOS/Linux).
2. Select the network interface (Wi-Fi adapter) and click Start.
3. Please wait 5-10 minutes for the program to collect data.
4. Stop the capture and analyze the results.

Please note:

• 🌍 Destination IP addressesIf your devices are making large-scale access to servers in unusual countries (e.g. 185.143.223.42 V Panama), this is a sign of a virus.
• 📦 ProtocolsViruses often use Telnet, SSH or non-standard ports (eg 4444, 3389).
• 🔄 Duplicate requestsBotnets send the same packets every few seconds.

To simplify the analysis, use filters:

ip.dst == 185.143.223.42 # Show traffic to a specific IP
tcp.port == 4444 # Show activity on port 4444
http.request.uri contains "login" # Find requests with logins

⚠️ Attention: Wireshark shows all Network traffic, including passwords and personal data. Do not use the program on public networks and do not save logs to cloud drives.

Method 3: Checking the router for vulnerabilities and backdoors

Many viruses enter the network through vulnerabilities in router firmwareManufacturers regularly release updates, but users rarely install them. According to research Avast73% of home routers run outdated software, making them an easy target for hackers.

To check your router:

1. Go to the web interface (usually at 192.168.0.1 or 192.168.1.1).
2. Find the section Firmware update (For example, Administration → Firmware Upgrade).
3. Check the current firmware version and compare it with the latest one on the manufacturer's website.

Update your firmware if a new version is available. Also check:

• 🔓 Administrator password. If it is standard (admin), change it to a complex one (for example, k7#pL9!vQ2$mN5).
• 🌐 Remote access. Disable it in settings (Remote Management → Disable).
• 🛡️ Firewall. Make sure it is turned on (Firewall → Enable).

Some router models have known vulnerabilities. For example:

Check if your model is on this list on the website CVEIf so, update your firmware immediately or replace your router.

How to find out the router model?

The model is usually indicated on a sticker on the bottom of the device. It can also be found in the web interface under Status or System Info.

Method 4: Scan devices on the network for viruses

Viruses can reside not only in the router but also on connected devices (computers, smartphones, and smart gadgets). Run a full scan of all devices on the network.

For Windows:

• 🛡️ Use Kaspersky Virus Removal Tool or Dr.Web CureIt! — they do not require installation and scan the system at a deep level.
• 🔍 Run the scan via Windows Defender: Start → Settings → Update & Security → Windows Security → Virus & threat protection.

For Android:

• 📱 Install Malwarebytes or Bitdefender Mobile Security and scan the device.
• 🔄 Check the list of installed applications: remove suspicious ones (for example, with names like System Update or Flash Player).

For iOS:

• 🍎 On iPhone Viruses are less common, but check:
  • Unusual battery consumption.
  • Spontaneous installation of applications.
  • Redirects to Safari.

Pay special attention smart devices (cameras, light bulbs, speakers). They often become part of botnets. For example, in 2026, a botnet Mirai infected more than 100,000 smart cameras Xiaomi in Europe. To check them out:

1. Disconnect the device from the network.
2. Reset it to factory settings (usually by pressing the button) Reset on the body).
3. Update the firmware via the manufacturer's official application.

Method 5: Checking DNS servers for spoofing

One of the common types of attacks is DNS server spoofing. Attackers change the router settings so that when you enter an address (for example, vk.com) you are being redirected to a phishing site. To check your DNS:

1. Log into your router's web interface.
2. Find the section WAN or Internet.
3. Check the fields Primary DNS And Secondary DNS.

Legitimate DNS servers:

• 🌍 Google Public DNS: 8.8.8.8 And 8.8.4.4.
• 🌍 Cloudflare DNS: 1.1.1.1 And 1.0.0.1.
• 🌍 Yandex.DNS: 77.88.8.8 And 77.88.8.1.

If you see other addresses (eg. 185.222.20.53 or 45.76.112.34), they were replaced. Restore the default DNS or manually specify reliable ones (for example, from Cloudflare).

Also check DNS on individual devices:

• 🖥️ Windows: Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings → Properties → IPv4.
• 📱 Android: Settings → Wi-Fi → Advanced → IP Settings (Static) → DNS 1/DNS 2.

⚠️ Attention: Some ISPs block DNS changes on their routers. If you can't change the settings, contact support and find out which DNS they use by default.

Method 6: Monitoring traffic consumption by device

Viruses and botnets often consume traffic in the background (for example, for mining or DDoS attacks). To identify anomalies:

1. Use the router's built-in tools. In the section Traffic Monitor or Statistics See how much traffic each device consumes.
2. Compare this to normal usage. For example, if a smartphone typically uses 2–3 GB per month and is currently using 20 GB, it's been hacked.

For a detailed analysis, install on your computer:

• 📊 GlassWire — shows traffic by application in real time.
• 📈 NetBalancer — allows you to limit traffic for suspicious processes.

Signs of viral activity:

• 📤 Continuous data sending (for example, 500 MB per hour while idle).
• 🌐 Connections to unknown IPs (especially in China, USA or the Netherlands).
• 🕒 Night activity (when all devices are turned off).

If you find a suspicious device:

1. Unplug it.
2. Scan with antivirus software.
3. If the virus is not found, reset the device to factory settings.

Method 7: Using specialized tools to check the network

If manual methods don't help, use professional network scanning tools:

• 🔍 Fing (For Android/iOS/Windows) - scans the network, detects unknown devices and vulnerabilities.
• 🛡️ Nmap (For PC) is an advanced port scanner that finds open ports and services on the network. The scanning command is:
  

  nmap -sV 192.168.1.0/24

• 🌐 Angry IP Scanner — quickly scans all IP addresses on the local network and displays active hosts.

To automatically check your router for vulnerabilities, use:

• 🔧 RouterScan - checks the router for known vulnerabilities (for example, CVE-2026-3000).
• 🔒 GRC ShieldsUP! — an online service for checking open ports (grc.com/shieldsup).

If the tools detect threats:

1. Update your router firmware.
2. Change your Wi-Fi and admin panel passwords.
3. Configure MAC address filtering.
4. Turn it off WPS And UPnP in the router settings.

⚠️ Attention: Some tools (eg. Nmap) may be blocked by your ISP or antivirus software. If the scan doesn't start, temporarily disable your firewall.

What to do if a virus is detected: a step-by-step action plan

If the scan confirms the presence of a virus on the network, follow the following steps:

1. Isolate infected devices:
   • Disconnect them from Wi-Fi.
   • If there is a virus in the router, disconnect it from the Internet (remove the cable WAN).
2. Remove the virus:
   • On PCs/smartphones, scan with an antivirus and remove malware.
   • On the router, reset the settings to factory defaults (Reset) and update the firmware.
3. Update all passwords:
   • Wi-Fi password (use WPA3).
   • Router admin panel password.
   • Passwords for important services (banks, social networks).
4. Set up protection:
   • Enable the firewall on your router.
   • Disable remote access (Remote Management).
   • Enable MAC address filtering.

Check your backups:

• If the virus encrypts files (for example, ransomware), restore data from backup.

After cleaning the network:

• 🔄 Restart your router and all devices.
• 📊 Set up traffic monitoring (for example, via GlassWire).
• 🔒 Update your router firmware regularly (every 2–3 months).

FAQ: Frequently asked questions about viruses on Wi-Fi networks

Can a Wi-Fi virus infect my smartphone if I haven't downloaded any files?

Yes, some viruses (eg. FluBot) are spread through vulnerabilities in the protocol Wi-Fi Direct or fake access points. Simply connecting to an infected network is enough to attack your device. Viruses can also penetrate through vulnerabilities in applications (for example, in older versions). WhatsApp or Telegram).

How to protect smart devices (cameras, speakers) from viruses?

Smart gadgets are often targeted by botnets due to their weak security. To protect them:

• 🔄 Update your firmware regularly using the official app.
• 🔒 Change default passwords (for example, for cameras) Xiaomi or TP-Link).
• 🌐 Connect them to the guest Wi-Fi network, not the main one.
• 🛡️ Disable unnecessary features (e.g. remote access).

Is it possible to check Wi-Fi for viruses from a phone without a computer?

Yes. Install on your smartphone:

• Fing — to scan the network and search for unknown devices.
• Network Analyzer — to check open ports.
• Malwarebytes — to search for viruses on the phone itself.

You can also use online services like GRC ShieldsUP! (but they are less accurate than PC software).

What should I do if my router is blocked by a virus and won't let me access the settings?

If a virus has changed the admin panel password or blocked access:

1. Reset the router to factory settings using the button Reset (hold for 10-15 seconds).
2. Connect to it via cable (not Wi-Fi) and log in with the standard login/password (admin/admin).
3. Update the firmware manually (download it from the manufacturer's website to another PC).
4. If the router still doesn't work, contact the manufacturer's support or replace the device.

How often should you check your Wi-Fi for viruses?

Recommended frequency of checks:

• 🏠 Home network: once every 3–6 months (or if infection is suspected).
• 🏢 Office network: once a month + real-time traffic monitoring.
• 🔒 After important events: connecting new devices, changing router settings, updating firmware.

Also set up notifications about new devices on the network (for example, via Fing or built-in router tools).