TerraMaster Forum

Hi, I'm another one with 100% cpu usage. As others have said, it's fine after a reboot for about 5 minutes then you get a random process name (that changes every time) taking up 80-90% cpu! At the moment mine is called "pbl1cbv1n8cmp56" running at 90.9% and using 0.4% memory.

i'm afraid to say random process names like that means that you have malware running on your unit

i dont know of any valid software that runs on these units that produce process names like that

Sorted. I ordered a new 4TB drive for the 2nd slot and re-installed from scratch with that one installed only. Once it was up and running, I simply put the original one back in the 2nd slot and it's working fine! OK, I had to remap the folders etc, but no great shakes there

* Note: It's now running around 6.7% CPU constantly.. and much more responsive in the menus obviously!

djay7 wrote: ↑12 Aug 2021, 19:08 Sorted. I ordered a new 4TB drive for the 2nd slot and re-installed from scratch with that one installed only. Once it was up and running, I simply put the original one back in the 2nd slot and it's working fine! OK, I had to remap the folders etc, but no great shakes there

* Note: It's now running around 6.7% CPU constantly.. and much more responsive in the menus obviously!

thats good news, i guess now you just need to be sure that any files you have stored on the nas drive arent infected with malware, it obviously came from somewhere, if you arent exposing the unit to the internet via port forwards etc it would suggest something was executed internally on your network so that may still happen again

Hi!
Your machine has infected with virus, and you can follow the steps below to remove the virus. If you can't operate it, you can let our engineers handle it remotely. If the guide method still fails to solve the problem, or the virus infection is different, please contact tech team to get more help.

Ways to check and remove viruses:
1. Log in to SSH terminal: viewtopic.php?f=78&t=2350
2. After logging in to the root user, check the CPU information
top
If it is pty10 virus, continue to operate.
3. Stop planning tasks
/etc/init.d/cron stop
4. Edit the configuration file that enters the scheduled task, delete the command line with the pty virus execution file.
vi /etc/crontabs/root
5. Delete virus execution files
rm -f /var/spool/cron/crontabs/root
6. Delete the startup script file of the pty10 system
vi /etc/inittab
According to the information in the file, find the pty10 virus path> view path, and then enter the folder path to delete the pty file.
For example: cd /usr/www/cgi-bin/> rm -f XXXpty
7. Search for system processes. If there is a pty process, delete it.
ps -ef |grep pty
kill -9 xxx (xxx is the process number)
8. Restart the TNAS device.