Hacked?

My BT fiber connection dropped about 20 mins ago.

I thought oh it'll come back up on it's own, it rarely goes down. I couldn't telnet into my HG612 which I thought was strange just for a PPP drop,

Ran a network scanner on my PC and every IP address including the one for my HG612 was being used by an unknown device?

I'm in the process of cleaning up a relatives virus ridden laptop which I thought was clean, has something flooded my local LAN?

Sounds almost like the laptop you throught was clean is running a bot of some description

Not an uncommon payload alongside the usual virus mixtures these days

Thought that.

It's the only device on my lan that I can think of that would cause it.

Looks like it's getting formatted then!

Just got home, same again, devices on every IP and PPP down.

If the case then the 'suspect' PC is off and not connected to LAN then consider this

https://www.theregister.co.uk/2016/12/08/talktalk_ro...

Other makes were also affected

Switched back to my Home Hub5 and the PPP has remained up since last night as expected.

Thought the firewall on the HG612 was capable?

In reply to a post by wolvesmad:

Thought the firewall on the HG612 was capable?

The HG612 is a modem. What router were you using with it?

All depends on how you've configured it, if using hg612 in router mode then a guide to some basic firewall changes is at http://wiki.kitz.co.uk/index.php/Huawei_HG612_-_Rout...

In reply to a post by wolvesmad:

Switched back to my Home Hub5 and the PPP has remained up since last night as expected.

Thought the firewall on the HG612 was capable?

The question you should really be asking is "why did the firewall on the router not do its job?" You should get the biggest hammer you can find and smash the culprit router into smithereens. Otherwise by continuing to use the same router you're not fixing anything and all that time spent formatting your hard disk(s) will be in vain. Even a £20 el-cheapo router from Argos will give you decent firewall protection.

Edited by deleted (Sat 29-Apr-17 11:47:58)

Firewalls are generally configured to block threats coming from the outside but if a compromised device is connected to the internal 'trusted' network, the firewall may very well be configured to allow all traffic from that device.

If a vulnerable router had port 23 TCP open for administration from the LAN (and many do by default), there would be no protection at all against a Mirai style trojan coming from an infected local device, which could then pwn the router.