Factory reset do to VPNFILTER

[dieter]

I'm currently running the latest FW for my RT-AC1900P.

Based upon the VPNFILTER malware, it has been recommended by Cisco Talos to reinitialize router to the factory settings, and reinstall the latest FW and settings.

If I back the router setting (before resetting to the original factory FW), reset the router to factory FW, reinstall the latest FW, then restore the current saved router settings, will the router be back to where it was before doing all of this?

Are there any risks in breaking the router?

 

[ColinTaylor]

https://www.snbforums.com/threads/cleaning-vpnfilter-malware-from-asus-rt-n66u.47083/#post-410409

 

[dieter]

I decided to do a factory reset, install the latest FW (which it did automatically), and restore my latest config setting.
All went ok!

 

[AndreiV]

If you are worried about malware /exploits the last thing to do is restore from a config file.

 

[dieter]

If you are worried about malware /exploits the last thing to do is restore from a config file.

WHY?? I thought the malware would reside in the FW code space and I thought the config file just contained my customization settings?

 

[ColinTaylor]

WHY?? I thought the malware would reside in the FW code space and I thought the config file just contained my customization settings?

No one knows how it achieves persistence at this time. Putting stuff in NVRAM would be an obvious way. By restoring your settings file you are restoring the NVRAM including any malicious code that was stored in there.

 

[dieter]

Thanks. OMG, what a disaster to have to manually restore all settings!!! Especially entering all those MAC filter addresses. But ...