Can't connect to SSH / CPU always 100%

[Nekle]

TOS version: 4.2.18-2110301149
Model: F2-221

--------------
Hello,
Since now 3 months my NAS is almost always at 100% of CPU used while nothing is running.
I went to check the logs and saw some "unknown process" running and ruining my CPU.



or





I wanted to connect to SSH to kill those process, but i can't connect to it.

I used the same accoun t/password as the one on the WEB interface, but i couldn't log on with ssh.

Does anyone knows what's happening to my NAS or how could I connect to SSH / change the ssh account /password ?

Thanks in advance !

[TMAY]

Hello, I can't view the picture you provided, please check which process is taking up too much at the specific time in the process of the control panel, and provide it to us, thank you.

[Nekle]

Hello,
thanks for your answer.

The process have some strange name like "g8f308tmov1d0s0" or "m5pl56nmir33lhf". They are all created by "root user" and use 100% of my CPU.

[TMSupport]

You need to log in to the SSH terminal with the administrator account you created for the first time.
Your machine has infected with virus. Please refer to the article to remove the virus. viewtopic.php?f=71&t=2292&p=12383

[Nekle]

{L_BUTTON_AT}TMSupport

Thank you for your answer, i'm going to check the topic to remove this virus!

For the SSH is there a way to reset to password because i don't remember the one i used the first time ?

[Nekle]

When i go to "Control panel > Terminal > ssh" it's written that

"The root user has maximum authority. Their password is always the same as the admin user’s password. Whenever the admin user’s password changes, the root password is also modified."

Doesn't it mean that my current password of the SSH is the same as the account I used to connect to the WEB interface which is also my "admin" account ?

[TMSupport]

Your interpretation is correct. If the admin user is the administrator user created when the system is initialized, then it can log in to the SSH terminal.
Log in to the SSH terminal

[Nekle]

i just connected to my NAs with SSH and this is the process with "top" command

10461 root 20 0 8.9m 0.0m 99.3 0.0 41247:13 R `- g8f308tmov1d0s0


And you can find in the attachement the content of the "vi /etc/crontabs/root'" command.

Could you still help me to get ride of this virus ?

[TMzethar]

{L_BUTTON_AT}Nekle

Hi, have you tried all the steps here? viewtopic.php?f=71&t=2292&p=12383&hilit=pty10#p12383 Are there still unresolved issues?

[Nekle]

{L_BUTTON_AT}TMzethar

I did but i I don't have any "pty" process running or anything with with "pty" in my "/usr/www/cgi-bin" folder.

i'll wait for somes days i think to see if the process run again. For now it's been 6h and it hasn't run yet