100% CPU usage

[ridinghero1990]

rebooted and now it's something else. after rebooting the cpu is like 20% for a little while then this starts again. just updating you guys.

the process is now w8407mm0mseb. it is using 90% of the cpu.

[sianderson]

that process name looks like malware process name, you are probably spamming lots of people right now without knowing it

my advice would be to backup your known good data, delete the partitions on the hard drive (s) by putting them in a PC and then set the nas drive back up as a brand new one, while more than likely you could SSH into the unit and remove the malware, the question would be is do you trust it again after just doing that or would be be better off with a clean install

you mention you cant back it up, are you not running with multiple hard drives as a raid array? in which case what would you have done if your hard drive had a fault (perhaps like this one), while i am only running one drive (at the moment) as i understand that larger hard drives are quite expensive (i have a 6TB drive), i have a usb backup of the data for this reason

[sianderson]

just a thought if you can prevent the Nas drive from having internet access either from the router or from the nas drive itself by changing its default gateway, it might fool the malware into thinking its offline therefore wont do much in terms of processing power, this should hopefully give you the access you need to remove the malware from running

[ridinghero1990]

I use Plex and need online connection for my friends that I share Plex with.

I logged into the NAS via Putty and killed the process by the ID. I asked around on the command to use. CPU is about 15-20% now. Of course if I reboot, a new process with a weird name and ID will return and take 100% of the CPU.

I also changed the http and https ports and made sure FTP was off. I had FTP on before for a friend to download a file, but I always turned it off because if I left it on I noticed weird attempts to access via FTP from foreign IP addresses. However, I noticed when the NAS reboots, FTP is back on. I just turned it off again.

What else can I do to secure the NAS? Do I need a NAS firewall? The instructions in the TOS screens are not clear. on how to set up a NAS firewall. Not sure when I'm doing, so I left it alone.

[ridinghero1990]

{L_BUTTON_AT}sianderson

I don't have another hard drive to back up the 5 or 6TB of movies and tv shows and personal files on the NAS. I'll have to do that another time. I'm using a 12TB Iron Wolf NAS hard drive. I would refresh the TOS via the option in the menus but I don't want to do anything that might destroy my files. I'm not sure what it means when someone on here mentioned that if you reset the NAS "you can't recreate a volume but it won't delete your data." Huh?

[sianderson]

sounds like these processes are being kicked off in a start up script (im not a linux expert so dont ask me where) or some sort so i'm sure a TM engineer will be able to find out where when they provide remote support to you

but heres another option if you can get hold of a smaller drive you could use that in Bay 1 (perhaps even a cheapish 128gb / 250gb SSD) might give you a performance boost as the OS would then run from this, install the system as a fresh, then i think you can put your 12TB drive in bay 2 and use it as a data drive, as its not in a raid array your data it should just be a standard EXT4 or BTRFS partition that linux can read natively

i would be concerned with setting up the 12tb again as it may want to re-intialise the entire disk and lose your data, atleast if its a separate hard drive you know you can just plug the old one into bay 1 and you are back at this point

[ridinghero1990]

IF I get a usb hard drive, can i plug it into the usb port in the back of the NAS and back up some things that way? never tried it.

[TMRyan]

{L_BUTTON_AT}ridinghero1990

Of course you can. Haven't the problem been solved remotely for you? Get technical support: viewtopic.php?f=75&t=608

[ridinghero1990]

Terramaster engineers solved it. Everything seems fine now. Now, to make a plan to back up some of my files just in case. Ha!

[justsimon]

What was the problem?
Was it malware?