I got a virus

Permissions, domain/LDAP, power, security, notification and more.
User avatar
OGStyle
Posts: 20
Joined: 15 Mar 2022, 03:34

I got a virus

Post by OGStyle »

I went to transfer some media to my NAS and I seen that there was readme files everywhere and all my media had been renamed. They all say ifire in there file names. I rebooted the NAS and now I can't even connect to it. I have not installed anything for ran any unsafe programs. The unit was working fine yesterday. Does anyone have any idea why this happened and how to fix my media?


The readme say
********************Your network has been infected!!!********************

IMPORTANT : DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED!!!

All your important files have been encrypted. Any attempts to restore your files with thrid-party software will be fatal for your files! Restore your data posible only buying private key from us. We have also downloaded a lot of private data from your network. If you do not contact us in a 5 days, we will post information about your breach on our public news webs.

You should get more information on our page, which is located in a Tor hidden network.
1.Download Tor browser - https://www.torproject.org/
2.Install Tor browser
3.Open link in Tor browser : aanb3upavmp5shyt6tw46owirfca65uba5f2re36hsacdehhyklmykyd.onion
4.Follow the instructions on this page

Your account on our website
*************************************************************************
username: ?
password:

ATTENTION:
1.Do not try to recover files yourself, this process can damage your data and recovery will become impossible.
2.Do not waste time trying to find the solution on the internet. The longer you wait, the higher will become the decryption key price.
3.Tor Browser may be blocked in your country or corporate network. Use Tor Browser over VPN.
User avatar
TMRyan
TerraMaster Team
Posts: 817
Joined: 01 Dec 2020, 11:50

Re: I got a virus

Post by TMRyan »

Please shut down your TNAS first to stop the encryption program, then you can contact our technical team for a remote inspection.
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement)
User avatar
seajayshome
Posts: 20
Joined: 12 Feb 2022, 00:38

Re: I got a virus

Post by seajayshome »

This looks like it is another malware variant... "IceFire"? :cry:

https://twitter.com/malwrhunterteam/sta ... 3406345224
User avatar
TMroy
TerraMaster Team
Posts: 2578
Joined: 10 Mar 2020, 14:04
China

Re: I got a virus

Post by TMroy »

{L_BUTTON_AT}OGStyle
what is your system version? do you configure your device by following the guideline?
To contact our team, please send email to following addresses, remember to replace (at) with @:
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
User avatar
OGStyle
Posts: 20
Joined: 15 Mar 2022, 03:34

Re: I got a virus

Post by OGStyle »

I have shut my NAS down. I'm using the OS provided by Terra Master. I'm only running a single 16tb drive. How do I find the system version?
User avatar
TMSupport
TerraMaster Team
Posts: 2314
Joined: 13 Dec 2019, 15:15

Re: I got a virus

Post by TMSupport »

You need to reinstall the system to prevent viruses from continuing to attack your device, more information.

You can find the TOS version in the login page.

Image
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
User avatar
OGStyle
Posts: 20
Joined: 15 Mar 2022, 03:34

Re: I got a virus

Post by OGStyle »

I can't even get to the login page. The browser says connection refused. I can use the Terra Master pc program and see the device. I can even get the folders and files to show that way.
User avatar
OGStyle
Posts: 20
Joined: 15 Mar 2022, 03:34

Re: I got a virus

Post by OGStyle »

Is there a tutorial on how to update my TOS without losing all my stuff?
User avatar
TMnorah
TerraMaster Team
Posts: 117
Joined: 17 Aug 2021, 09:51

Re: I got a virus

Post by TMnorah »

Hi, please follow this guide to reinstall your system: viewtopic.php?f=76&t=423
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
User avatar
OGStyle
Posts: 20
Joined: 15 Mar 2022, 03:34

Re: I got a virus

Post by OGStyle »

Would it be safe for me to hook the NAS drive up to my Windows system? I want to see how many files are damaged. What is TOS built from?

Thanks
Locked