Think maybe my Asus AC1900P with Merlin Firmware has been compromised. Need some help .

[Davidncali001]

What I am about to explain in detail was discovered after I installed the latest beta 2 firmware from Merlin and directly after I uninstalled a Windows 10 VPN client called CyberGhost. So updated Merlin, then immediately uninstalled CyberGhost VPN Windows 10 client.

I discovered a network adapter on my PC and the name was called Incoming Connections. Mind you I have never seen this before. I double clicked it and it said no clients connected. Did some research and found out it's for letting people connect to your PC over the internet. I uninstalled that network adapter and decided to make sure my router hadn't been compromised.

So everything on the router looked like the setting I had originally setup. I did then run the netstat utility inside asus merlin and found a bunch of very odd entries that in all my years of using the Merlin firmware have never seen. I will list all the strange netstat entries below:

datametrics
sa-msg-port
radius
radacct
squid
afbackup

All of the entries I have listed above had a Time Wait entry next to them.

So my question is, is has my router been compromised? What are those entries from netstat and what is that Windows 10 network adapter doing on my PC?

If my router has been compromised what should I do?

Thanks for your time,

David

 

[FreshJR]

Stop worrying.

"Incoming connection" was a virtual network adapter to handle the VPN traffic.
Cyberghost looks like a respectable company.
It was correctly setup and needed a virtual network adapter to do its job.

As for your routers security, you should NOT have this setting enabled in your RoutersUI:

Enable Web Access from WAN = Yes
Enable SSH = LAN + WAN

You should also of had a decent password on access your router.

If the above are met, then you are super safe.

Next, these settings should be disabled, unless you are actively using them.

Enable Telnet No
Enable SSH No


I doubt anything happened, but you can boot the router in "Recovery Mode", reflash the firmware, and clear the NVRAM.
When that happens the router is 100% back to factory. Little overkill steps after installing a paid VPN that worked correctly.

 

[Davidncali001]

Thank You for easing my mind! I really appreciate it.

David

Stop worrying.

"Incoming connection" was a virtual network adapter to handle the VPN traffic.
Cyberghost looks like a respectable company.
It was correctly setup and needed a virtual network adapter to do its job.

As for your routers security, you should NOT have this setting enabled in your RoutersUI:

Enable Web Access from WAN = Yes
Enable SSH = LAN + WAN

You should also of had a decent password on access your router.

If the above are met, then you are super safe.

Next, these settings should be disabled, unless you are actively using them.

Enable Telnet No
Enable SSH No


I doubt anything happened, but you can boot the router in "Recovery Mode", reflash the firmware, and clear the NVRAM.
When that happens the router is 100% back to factory. Little overkill steps after installing a paid VPN that worked correctly.

 

[bilboSNB]

Why would squid be running unless specifically installed?

 

[FreshJR]

Those were running on the router??

What was the installed directory under netstat?