RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

[bluzfanmr1]

I think you're talking about Trend Micro update. Not aware of a way to update asd from the gui manually, it runs automatically in the middle of the night by itself. Unless something has changed...

My bad. I was thinking they were the same.

 

[iFrogMac]

I just finished reading through this thread. I was curious about the issue when this thread was linked on a thread about the RT-AX86 wireless dying and needing to have it's info put back such as country codes.
I have checked my recently purchased and configured BE92U, and the only feature I use is UPNP for the occasional app such as transmission which can randomize it's port. AICloud all toggles are off here remote WAN is off as well as remote access in the Asus Router app. I've never had any kind of issue like this mentioned, however I thought it was a good idea to read through the thread and check my settings to make sure I wasn't at risk.

Any updates I've received to firmware is on the initial set up out of the box. I disabled automatic firmware updates, but left automatic security updates enabled. So far no problems here to report, butt after reading through this am glad the older RT-AX86U is no longer the primary router, especially since it hasn't received any updates since the update ending in 43. I've also disabled remote access for Plex since I don't need that function anymore. I also use the ShieldsUP tool on the Gibson research site as a baseline test to see if I have anything open that should be closed, and I usually get the green checkmark that everything is OK even with the UPNP probe.

 

[giosita]

Can you please confirm those are the files found in /jffs/asd? Here's what I see for my RT-AX86U Pro with 388.8_2. I did not have to manually reboot the router. Thanks in advance.

View attachment 62214

Would someone kindly share these files?

 

[Cornflakesninjan]

I have the router RT-AX58U (Firmware: 3004.388.8_2) but the same problem, but i put it behind another router and firewall in the meantime and that blocked everything off while i was checking out this issue and also found this forum. But i still have it intact as it was.
This .txt file is actually a .zip that contains the contents of the folders requested.

/jffs/asd/
blockdnsip2023080803
blockfile2024102501
chknvram2024102202
monitorproc2024102502
version

And also these log files from /jffs/
asd.log
asd_json

They all seem encrypted but looking at the behavior of the routers, i would strongly suspect some sort of crypto mining on hacked routers.
In my case it pushed almost 1 gbit out for quite a while (as i am on a connection like that).
So that´s pretty much a few gb of data from every package, then it stops and swaps to downloading something at around 30mbit, held like that for like 30sec while only using one cpu core, then max usage for a few min again.

So my five cents is that it really seems like cluster behavior, Receive a package, Do the work, Submit your result, get a new package and repeat 24/7.

 

[Cornflakesninjan]

Would someone kindly share these files?

see my post above this one. *sorry forgot to press reply. just registered here to see if i could help out.