malware that runs on a computer on your local network and modifies the setting on your router has been around for 5 years or so, see DNSchanger

Always set the admin password on your router.