Asus Router Issues

[71LoveTech]

Hi, I'm hard wired to Asus Router RT AC1200 and I'm reading the system log which has a lot of strange issues going on over a Samba Server,
This is an issue: @@@ ed_monitor_exit : ===>

I've seen rc services to

hour monitor: daemon is starting
hour monitor: daemon terminates

And I also have a mac address which when I tried to look it up, I just got another page of another site to click, so I was not able to reach a website that would allow me to look up this mac address. From my devices I do not see this mac address on the router.

rc_service: udhcpc 7481:notify_rc stop_upnp
Nov 18 20:46:31 rc_service: waitting "start_firewall" via udhcpc ...

mt76x2_calibration(channel = 42)

I read something on this and looked it up and it seemed that they watched me changed my router password,
I saw the word chpasswd in the system log and now I cannot find it. I just found it, sometimes it seems like someone is at the cmd line and they don't let me find certain things I'm going back to look for and then I type it out that I cannot find it and then I can go back to the very same spot, and find it like they re entered it or allow a normal keyboard function to be executed. Like the space-bar, there are times when two many spaces get put in and then there are times with I did click on the space-bar and nothing happened.

I don't mind uploading a screenshot, I have to take them and then another because the date will get messed up on it. So, I have to open file information and take a screenshot of it that way. I just don't want to share or know what I can share.

rc_service: httpd 7535:notify_rc chpass
Nov 18 20:49:34 rc_service: httpd 7535:notify_rc restart_ftpsamba

I would take any and all the help I can get over this issue.

Thank you

 

[lunarlander]

hour monitor: daemon is starting
hour monitor: daemon terminates

The above doesn't seem suspicous to me. Daemons/Services can start and stop by themselves and some activate on a schedule.

What 'web site' are to try to go to to look up this MAC address? If you are talking about a 'web site' as in out in the internet, you wont' find one, because MAC addresses are local the Local Area Network and never passes out to the internet.

If you suspect tampering by command line, just disable SSH feature, and don't enable Remote Management.

Swap your keyboard with a known good one and test before and after with Notepad.

Are you sure that your computer is secure? If your pc has been hacked, then it could be under remote control, and all sort of misbehavior can result. If in doubt, disconnect from the network (unplug router from the internet), back up your documents and pictures and reinstall Windows. Then, while offline, create a disk image of your virgin pre-network-connection state with a disk image program like Macrium Free to an external USB drive. This way, you can quickly restore (5 mins) the image if you suspect tampering.

Then reset router with the pin hole on the router, change router password and configure the router to the way you want. Only then, reconnect the router to the internet.