2hotspot software dangerous in the wrong hands...
I live in a block with a shared WIFI ADSL connection, about 70 users. Most of the people in the building have no access to the internet which they have paid for, it has been like this intermittently for several months and nobody seems to know what was causing it or how to fix it.
I have been asked to help out, and get the system running. I just did a preliminary investigation on the network, so I can offer some help.
One of the users here seems to have installed this 2hotspot controller program on his PC, probably because he thought it would be a good idea to share his connection with friends and get 2hotspot to pay him commission.
Here's what it does, based on my quick look today.
The user has a genuine IP on the network. However it also has 2 others on a different subnet. One acts as a DHCP server, and the other is a HTTP server.
His machine intercepts DHCP requests for an IP address from other users and issues an IP address in this unauthorised subnet, so they cannot then connect to the internet on the block's "real" network. It redirects them to another fake IP hosting a HTTP server advertising 2hotspot. After that, you're stuffed....
Once issued, the only way for this to set itself right is for
a) The machine given the fake IP needs to time out and request a renewal via DHCP of it's address. Depending on how long the lease was, that could take an hour/day/days/weeks' etc...
b) The offending machine with 2hotspot needs to be OFFLINE so it cannot reply, and then the DHCP renewal request will eventually be sent to the block's router and be issued with a genuine IP again. As this guy doesn't go offline often, this has been a real problem for many months!
So you see, what a mess this leaves you in.
Since this first guy, now there seem to be about 5 more fake DHCP servers popping up - it is spreading like poison ivy
. Exactly why, I am not yet sure.
You at least know who the user is - it's yourself! This makes it easier.
Go to the \windows\system32\drivers folder and delete the file ACONTROL.SYS. There may be others, but this one seems to be the key, and it doesn't like being deleted! If it won't let you, search the internet to get help on deleting resistant files. Try Unlocker.
Lastly, I know from various people in the industry that this company's pile of crock software has caused similar problems across several continents. I would personally classify it as a virus/rootkit. The authors and distributors of this software are in my opinion very irresponsible to let people install this program without any idea of the problems it causes for others.
For any other network administrators out there, this is a classic example of what happens when no controls are placed on users of a communal wifi system!
Good luck
John
