Manually DHCP List and Domain Name Showing Unremovable Items

[ColinTaylor]

I’m suspicious of the /jffs/usericon/asd_kkoS file and its bind mount.

Yes I'm assuming that's part of the malware as well.

There's another file I also don't recognise:

/jffs/.sbin/hostapd

 

[dave14305]

Yes I'm assuming that's part of the malware as well.

I mean, why bind mount a user icon file unless it will somehow exploit the webgui when loaded on the networkmap? It's amazing the router is functional if rc has been hacked or patched on-device.

 

[ppfoong]

I have an idea of forking and modifying the WICENS addon to monitor whether AiCloud is turned on or any external access is opened up. If found, it will email out an alert.

Perhaps this will become another useful addon for security checking.

Or maybe @Maverickcdn has the interest to extend the function of WICENS to include this kind of basic security checking?