I think my routers been compromised

[yarr]

What do I do in this situation? Please have a look at this log

 

[L&LD]

What do I do in this situation? Please have a look at this log

There is no log attached.

Immediately disconnect from the internet. Do a full reset to factory defaults. Clear the NVRAM via the WPS method, format on next boot the jffs.

I would consider any file on the router not worth saving at this point.

Do a full minimal and manual configuration to secure your router and connect to your ISP.

I would repeat all the above after downloading the latest firmware again (even if it is only the same firmware you currently have installed) and flash the router and do the above steps again.

 

[yarr]

Thank you it's bad. If the lot would be helpful I can find some other way

 

[AndreiV]

https://www.snbforums.com/threads/faq-read-me-first-before-posting-a-question.47153/

Security

Q: My router got hacked, language is now Korean, etc... What do I do?

A: Restore to factory default, and this time make sure you don't open your webui to the WAN interface. Use a VPN if you need remote access to your router.

As L&LD stated , disconnect and restore to factory default.

 

[adrianTNT]

I had a similar situation and I suspect the hacking affected the ability to re-flash the router, it only worked with a smaller firmware (Merlin 378.55_0 ~28MB), and after that reflash, it worked with larger firmware.
Maybe that helps to save some days of struggle

 

[rnatalli]

Complete wipe and reflash as suggested already. Or, it’s a good excuse to buy a new router [emoji846]


Sent from my iPhone using Tapatalk

 

[yarr]

I bought a new router only to find out that the computers were infected with some kind of rootkit that survives using active kill disk. I just wasnt confident enough that I would pull off a proper reset/risk felt too high. I appreciate you all trying to help. Now it's time to figure out how to fix my other problem

 

[L&LD]

Be sure that if/when you can remove the rootkits from the computers, that the router wasn't re-infected again too.

I'm positive you can do a proper reset to factory defaults. You can follow the steps in the links in my signature below.

Which router did you end up buying?

 

[yarr]

This sounds kind of funny but I'm afraid because it's a GT-AC5300 and all the bells and whistles give the sucker a better place to try and hide. The replacement is just an ASUS 1900 but now that I think about it maybe I should have got a different company this time around. Also, do you mean to say that it might be possible that the router could be infected again even if it hasn't been connected to a PC? Malware creators are buttheads. This is stressful

 

[ColinTaylor]

This sounds kind of funny but I'm afraid because it's a GT-AC5300 and all the bells and whistles give the sucker a better place to try and hide. The replacement is just an ASUS 1900 but now that I think about it maybe I should have got a different company this time around. Also, do you mean to say that it might be possible that the router could be infected again even if it hasn't been connected to a PC? Malware creators are buttheads. This is stressful

From the limited information you have provided it sounds like your problems are entirely to do with your PC's and nothing to do with the router. So whilst it's not impossible that you have some malware that infected your router as well as your PC's IMHO it's extremely unlikely. Just for peace of mind you might want to perform a standard factory reset on router the after removing the malware from your PC's, but it's probably not necessary.

 

[L&LD]

This sounds kind of funny but I'm afraid because it's a GT-AC5300 and all the bells and whistles give the sucker a better place to try and hide. The replacement is just an ASUS 1900 but now that I think about it maybe I should have got a different company this time around. Also, do you mean to say that it might be possible that the router could be infected again even if it hasn't been connected to a PC? Malware creators are buttheads. This is stressful

I agree with ColinTaylor, but yes, the router need not be connected directly to a PC. Malware, once inside a network, can re-infect any device within that network again. 'Direct' connection not required, but wired or wireless, it is effectively a direct connection in any case.

You would not be any less susceptible using another router brand.

Your best move forward would be to take your whole network offline (unplug power, Internet (ISP) and all other Ethernet cables), remove the remaining malware from the computers, reset your router to factory defaults including formatting the jffs partition and doing a WPS NVRAM erase.

After verifying that there are no more devices infected within your network (make sure to double check any backups, NAS, USB drives, CD's, etc. where malware might reside, then you can connect to your ISP with your fully reset router, and then start connecting your devices again.

It sounds like a lot, but it is simply a little time-consuming to be this thorough.