How to check if your TNAS is attacked by the Deadbolt ransomware?

Official announcements and latest news, awards from medias, and sucess stories.
Post Reply
User avatar
TMSupport
TerraMaster Team
Posts: 2314
Joined: 13 Dec 2019, 15:15

How to check if your TNAS is attacked by the Deadbolt ransomware?

Post by TMSupport »

How to check if your TNAS is attacked by the Deadbolt ransomware?

Method 1:
Enter the TNAS IP in the browser address bar. If the following page appears on the login interface, it means that your TNAS has been attacked by the Deadbolt ransomware.
Image

Method 2:
1. Log in to the SSH terminal
2. Execute the command to check if there are files with the word "Dead".

Code: Select all

ls -lh /usr/bin/dead-tool
3. Execute the command to check if there are files with the word "dead-tool、pty10、qnx".

Code: Select all

cat /etc/crontabs/root
Image

After executing the command, if you see a file with the words "Dead, dead-tool, pty10, qnx", it indicate that your TNAS has been attacked by Deadbolt ransomware. Please refer to the guide to remove the virus.
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
User avatar
V8Triker
Posts: 82
Joined: 26 Feb 2021, 19:18
Great Britain

Re: How to check if your TNAS is attacked by the Deadbolt ransomware?

Post by V8Triker »

Apologies, but your second screenshot can cause confusion.

It shows a system that is NOT infected, yet the following statement suggests it would indicate that it is infected.
User avatar
TMSupport
TerraMaster Team
Posts: 2314
Joined: 13 Dec 2019, 15:15

Re: How to check if your TNAS is attacked by the Deadbolt ransomware?

Post by TMSupport »

{L_BUTTON_AT}V8Triker

Sorry to confuse you, the second image just demonstrates the execution steps of the command.
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
User avatar
V8Triker
Posts: 82
Joined: 26 Feb 2021, 19:18
Great Britain

Re: How to check if your TNAS is attacked by the Deadbolt ransomware?

Post by V8Triker »

@TMSupport

It did not confuse me, but it may confuse others :)

Thank you for posting this, though.
It is good to be able to confirm that my system is Deadbolt free.
Post Reply