TNAS F5-221 CPU at 100%

CPU, memory, fan, process, services status, system log, tempreture
Locked
User avatar
frostyxyz
Posts: 3
Joined: 08 Mar 2022, 03:59

TNAS F5-221 CPU at 100%

Post by frostyxyz »

Hi I've just noticed my system is running constantly at 100% and it's mainly a process called systemd-firewal that's causing it. Do you know what this is and if if I can somehow disable it?
Many thanks.
Attachments
picture of the top three processes, rest were at 0% at the time.
picture of the top three processes, rest were at 0% at the time.
User avatar
TMSupport
TerraMaster Team
Posts: 2314
Joined: 13 Dec 2019, 15:15

Re: TNAS F5-221 CPU at 100%

Post by TMSupport »

Your machine has infected with the mining virus, please follow the steps below to remove the virus.
1.Log in to the SSH terminal
2.Switch to the bin directory.

Code: Select all

cd /bin/
3.Delete virus execution files.

Code: Select all

rm -rf ./systemd-firewal
4.Find the process id of systemd-firewal.

Code: Select all

ps -ef|grep systemd-firewal
5.Kill the process.(ID is the process id)

Code: Select all

kill -9 ID
6.Restart the TNAS device.
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
User avatar
Hardfecx
Posts: 244
Joined: 04 Jun 2020, 23:17

Re: TNAS F5-221 CPU at 100%

Post by Hardfecx »

and how to delete the process completely?
User avatar
TMRyan
TerraMaster Team
Posts: 817
Joined: 01 Dec 2020, 11:50

Re: TNAS F5-221 CPU at 100%

Post by TMRyan »

After deleting the systemd-firewal file and killing the process, the miner is removed.
To clean it up completely you can use the following command to delete the line of code that has firewall in it.

Code: Select all

vi /etc/crontabs/root
In other cases, you can refer to the following: viewtopic.php?f=71&t=2292&p=12383&hilit=pty10#p12383
To contact our team, please send email to following addresses, remember to replace (at) with @
Technical team: support(at)terra-master.com (for technical support)
Service team: service(at)terra-master.com (for purchasing, return, replacement)
User avatar
frostyxyz
Posts: 3
Joined: 08 Mar 2022, 03:59

Re: TNAS F5-221 CPU at 100%

Post by frostyxyz »

Hi,

Thank you for your replies. Ok I managed to do all that above. And it kills it but seconds later a new process with a same name but with a different process id takes it's place.
i.e. I've done the following steps:
Login to SSH via putty
cd /
sudo -i
[password]
cd /bin/
rm -rf ./systemd-firewal
ps -ef|grep systemd-firewal
kill -9 [the first number shown in the ps]
vi /etc/crontabs/root
... then manually deleted the line with the firewal

Any ideas?
Thanks
User avatar
frostyxyz
Posts: 3
Joined: 08 Mar 2022, 03:59

Re: TNAS F5-221 CPU at 100%

Post by frostyxyz »

I may have now resolved the issue. After doing the above, I did some of the steps in suggested by TMRyan here:
viewtopic.php?f=71&t=2292&p=12383&hilit=pty10#p12383

I then restarted the TNAS and so far, the process hasn't returned. I'll be sure to come back here if it comes back though. :)

Thank you all.
Locked