I got an email message a month ago from my ISP saying the government had notified them that my computer was infected by SSL freak and to take action.
I checked on my TP-Link router and found my NAT firewall had port 22, 80, 443, 21, 20, 50000 & 50001 forwarded to my computer which I did not do.
I deleted the port forwards only to find them come back again.
I disabled them and they stayed disabled and then disappeared not to return.
Yesterday my internet stopped working on all the devices in my house dispite every thing seeming fine.
I restarted the modem and it worked for 30 seconds and then stopped working again.
I restored my modem to factory settings and low and behold the Port forwards returned in the NATs again.
I then went to TP-Links website and downloaded the firmware again and flashed the modem with clean firmware and reset my modem. I removed the desktop computer from the network that was being forwarded to incase that was where it was coming from. When I checked the NAT on my modem the port forwards where back again. I have another modem in the house which works fine when I hook up.
I have googled for modem virus's but there isn't a great deal of information around. Has anyone dealt with this type of thing before.