RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

[Cornflakesninjan]

I have the router RT-AX58U (Firmware: 3004.388.8_2) but the same problem, but i put it behind another router and firewall in the meantime and that blocked everything off while i was checking out this issue and also found this forum. But i still have it intact as it was.
This .txt file is actually a .zip that contains the contents of the folders requested.

/jffs/asd/
blockdnsip2023080803
blockfile2024102501
chknvram2024102202
monitorproc2024102502
version

And also these log files from /jffs/
asd.log
asd_json

They all seem encrypted but looking at the behavior of the routers, i would strongly suspect some sort of crypto mining on hacked routers.
In my case it pushed almost 1 gbit out for quite a while (as i am on a connection like that).
So that´s pretty much a few gb of data from every package, then it stops and swaps to downloading something at around 30mbit, held like that for like 30sec while only using one cpu core, then max usage for a few min again.

So my five cents is that it really seems like cluster behavior, Receive a package, Do the work, Submit your result, get a new package and repeat 24/7.


*Edit: Removed the files as it was mentioned to not share them further down.

 

[Cornflakesninjan]

Would someone kindly share these files?

see my post above this one. *sorry forgot to press reply. just registered here to see if i could help out.

 

[chicho]

Hi! I have been struggling with this topic for almost 2 weeks. I have AM micro internet (30/15), sometimes my upload was 90 Mb/s. I called my service provider every day until he realized that there was a large amount of data flow on port 16881. This port was closed by my service provider 1 week ago and I don't have any problems with it. I have an RT-AX59U router...

 

[bennor]

I have an RT-AX59U router...

What firmware version are you running on the router?

 

[RMerlin]

Don`t share/copy ASD signature files between routers. They vary between models based on the version of the asd daemon, and also Asuswrt-Merlin uses different signatures than the stock firmware. Just let your router get them from Asus. If you absolutely must force an update for some reason, just delete the files, they will be re-downloaded.

 

[chicho]

What firmware version are you running on the router?

Sorry, currently running this version:: 3.0.0.4.388_33392

 

[devhell]

3004.388.8_2
asd process loading CPU on 30-50%
asd.log is encrypted

I'm trying delete any files and kill asd process but after reboot all repeated again

 

[bennor]

I'm trying delete any files and kill asd process but after reboot all repeated again

As RMerlin indicated a few posts up, if you delete the ASD files in the /jffs/asd/ folder they will be redownloaded from Asus when you reboot the router. This generally is normal operating procedure.

 

[Klosiak]

A new update to RT-AX86U where some fixes to AiCloud 2.0 security are mentioned.

 

[bennor]

A new update to RT-AX86U where some fixes to AiCloud 2.0 security are mentioned.

FYI. The 3004.388_4 release thread discussion.

Release - Asuswrt-Merlin 3004.388.8_4 is now available

Asuswrt-Merlin 3004.388.8_4 is now available for all Wifi 6 models. 3004.388.8_4 (17-Nov-2024) - CHANGED: VPN killswitch will now only be active if the VPN client itself is enabled. If you stop/start the client yourself over SSH, you need to also...

www.snbforums.com