Thanks for your input. AV is used on computers and is kept up to date.
Your two points regading port forwarding and dyndns - which I use - led to me factory reset the router and therefore lose the above. Despite that and within a few hours I began to see the same type of message being logged from various regions of the world.
The message would make it look like the router has been logged into somehow. But apart from the admin account, are there any other available accounts to get in on these routers? I've searched all over the place to get some info on this and are not finding much so any help is appreciated.