How to Completely Wipe Compromized Router?

RouterOS Beginner Basics
1

I have a Mikrotik router that was compromized. What is the best/safest way to completely wipe the router of all software and configs and build it back up from scratch to make it look like factory condition and remove any potential malicious things that may have beein installed on it?

I saw this mini tutorial but it does not look like it really wipes things to the deepest level that I’m looking for. https://www.mikrotik.com.my/reset-to-factory-default-settings/

thanks.

2

netinstall

3

Dont reuse any of the user names or passwords either…

4

As said before:

  1. Netinstall
  2. Don’t reuse usernames and passwords

Also:

  1. Don restore from backup (it’s a binary copy, and WILL bring everything bad back)
  2. Restore from “export” - AFTER vetting each line, to make sure nothing untold comes back.
  3. There is things that export don’t bring back. From memory: certificates and ssh keys. Check everything else.

After that, You should have your router back.

5

Thanks. This worked nicely. Is it normal for the ip address of the deice to show up in winbox as 0.0.0.0 after flashing a new copy of routeros with netinstall? It wasn’t until after I reset the configureates back to factory default in winbox that the ip address went back to 192.168.88.1. I think this is normal, but just wanted to confirm that with you guys. The reason I think it’s normal because the netinstall flash operation formats the device and wipes out all configurations so the device doesn’t even have an ip address unitl I reset the configuration back to default.

6

Yes, is normal to do not have any config after netinstall.

For have the default values after netinstall must be checked “Apply default config”

For keep previous config select “Keep old configuration”,
but NO, do not do it, on your case if the router is compromised…