Mystery log-ons to my home router (speedtouch), malware?

[billytkid]

Hiya,

hope you can help with this one!

I've got a home network with a number of PC's and Mac's on it and one of the PC's started having trouble with the wireless after each reboot, in addition to this I noticed (after much looking) that the machine was trying unsuccessully to log on via http to my router.

The machine is 'protected' by Onecare and I ran I full scan from that, then removed onecare and did a full kaspersky scan, both came up negative with nothing found.

In the end I reinstalled Windows (sadly I coudnt do a format and clean install, but did install over the top of the old version), this sorted the wireless issue, however I've noticed that the log on attempts continue.

In addition to this another PC on the network (also runnning onecare for protection) is trying to log on to the router numerous times.

The router is a Speedtouch, both macines are running XP.

I have followed all requested instructions and have run ATF cleaner, windows removal tool, malwares (found nothing), ran EST online scanner (found Win32/Agent.OBH - report attached), I have tried to run DSS however it crashes at Examining Event Logs.

I would greatly appreciate if someone can have a look and let me know their thoughts on what this could be.

Many thanks

btk

[steven woodman]

You say and outside source is loging on to router or a pc inside you network.

[billytkid]

Its the infected PC on the home LAN that is trying to access the router. Incidentally I also have another computer with the same behaviour so I'm guessing this something on both of them.

Thanks

[steven woodman]

well, have you tried maually deleting the file/folder in safe mode?

[billytkid]

I can delete the folder no probs, however wasnt sure if this was best to do first as it seems very strage that neither onecare nor caspersky can spot the virus. I wasnt sure if you guys on here like looking at new strains?

I'll delete in a mo and reboot if thats ok?

[notcoolzeus]

Yup i got the same problem, my computer tries to login to the router via http using various user/passwords such as admin, motorola, badcred. It does this exactly every minute. Anti-virus finds nothing. Shrugs, FYI. Gonna wipe the hard drive and reinstall windows.