Recent content by vaboro

@virus_59 the solution is to stop lighttpd. The picture on the page you're referring to shows that it's running along with the Sofia process. But the fact is that the Sofia process most probably got into the system because lighttpd is running, imho.

What fw exactly? Have you also installed entware? Entware is needed to install htop that has been used to spot unusual process, sshd, and its descentant threads in router's memory.

Alright, but do you have AiCloud services enabled? (I guess my question was imprecise since the service may not be used by can still be enabled). You may find it usefull to have a look at the following topics: 1)...

This is the key :) I guess hence the name of the app.

@arturk have you tried Instant Guard App by Asus? I use it regularly on my iphone to establish vpn connection from cellular network to home lan. I assume Asus should also have its Instant Guard App published on Google Play.

👍

@cowboy have you considered other dns proxies?

Do you have WAN access to router ui enabled? Do you use AiCloud? What's your router model? What's your router's firmware?

They're all relatively safe to use, imho. Although TOR kinda stands out as it has a particular purpose of hiding real ip. You can use whatever VPN is easier and/or more convenient for you to set up. I use openvpn and charon (Instant Guard tab).

Yeah, but I was just curious :)

Have you tried to enable WAN access to router ui and/or AiClould to obtain a copy of malware executable on your device?

You may consider using VPN. Charon (Strongswan) can be quite useful and is relatively easy to set up. Instant Guard app on a mobile device is used to access LAN from WAN. Other VPN types can definitely also be used.

@arturk WAN access to web ui and everything related to AiCloud (except ddns service) should be disabled to stop all this madness that is happening to you. You can continue using ddns safely though. It's on inadyn which seems to be safe for now.

You're right, sorry for confusion. My mistake. Although I had it right in my original post.

No WAN access but I used AiCloud. As soon as I switched off the AiCloud the problem stopped.