WRVS4400n - hacked?

[mjwestkamper]

We opened shop today to find the WRVS4400N was reset to defaults with two exceptions; it would allow WAN changes, and there was a HxtR service for port forwarding to 4192.

We had several VPN tunnels programed and no port forwarding. We had a non-standard DHCP as well as a custom LAN subnet.

Methinks the router has been hacked.

How can I tell if the firmware is not stock or the programming is corrupted?

I did the reset thing, however does that really erase everything?

Next, how can I reset this router to be ABSOLUTELY sure there is nothing afoot?

Any help will be really appreciated.

Mike

[Tom Watts]

Hello Mike,

You may reset the router by holding reset for 30 seconds using a pencil or paper clip or any non-damaging object.

You may log in to the router and go to Status -> Gateway to check the firmware version. You may upgrade to the latest code going to Admin -> Firmware upgrade.

You may download the latest code from the www.cisco.com. Type WRVS4400N firmware in the search box, click search. Navigate to 'software results'. The latest code is 2.0.2.1

-Tom