About this question
I have already read those 3 topics about WPAD attacks but I'm still confused, so I'm here looking for a deeper explanation.
CONTEXT
I think a WPAD attack is happening in my home and I was not aware about what WPAD is until now. A svchost.exe process was connecting to some dubious IP (185, 38, 111, 1) through port 80 every 10 minutes. While going to wpad/wpad.dat in my browser I was receiving a blank page and I tried to block that IP in my firewall. After that, everytime I access wpad/wpad.dat my firewall blocks the connection because it's going to that IP. I did a factory reset on my router but the problem persisted. Searching about this situation, I found more people having the same problem with the same IP. One of those people said he dealt with it just by changing his router's DHCP Domain Name. I decided to try it and I changed mine (which was always "domain.name") to something random, like "sweet.candy".
I tested that suggestion for an entire day and, to my surprise, the problem suddenly stopped and that connection didn't appear anymore. Going to wpad/wpad.dat now, I'm receiving a message saying that my browser could not reach that address (which was, according to that person's suggestion, the desired outcome). However, after that, I read this Sophos article, which says we shouldn't make up domain names, so I reverted DHCP Domain Name back to "domain.name".
I already turned off "Automatically detect proxy settings" in my PC, but there is one PC in my network which was connecting to that malicious IP too even with that option always being off.
QUESTIONS
Where is the wpad.dat file? Is it on the router or on my PC? Is there a way to edit it?
If is it in the router, how is it possible that a factory reset didn't revert it to normal state? Does changing the router's DHCP Domain Name just hide the attack or really solve it? And does changing it impose any risk?
Are devices other than PCs, like smartphones, affected by this attack?
It seems some people get rid of this attack after changing the router. Even if I do that, how can I protect the next router against this attack?
Routers are unfortunately often cheap devices in a competitive market, with vendors more interested in cutting costs. This often results in security issues. What you encounter is only one of many problems. There is a whole website dedicated to the topic of insecure routers.
