TerraMaster Forum

Hi all,
from some days I experimented some problem using the emby server from NAS, before , some days ago all works fine, all the movies was streaming from remote without problem, now when I try to see the same movies after some second\minute the movies stop.... I also noticed that if you open the web interface while before the status screen (cpu load, bandwith used and so on) was update in real time , now it remais freeze and I have to refresh the screen.
I checked inside the process running and discovered some strange process ON. look , one of this process is named aaaaaaaaa ,
nobody experimented the same situation?
thx
\Gianni

100% sure you are infected.

Same process ended up in ransomware trying to encript my data. Disconect NAS from internet, fresh install (from file not online) after removing disks from the NAS and good luck.

Hi,

I am pretty sure I had this process spotted as well, and got rid of it. Not sure though whether it's harmful.

I am also worried by 2 processes (paranoid mode) that seem odd but maybe someone from support team can confirm if they are known or not:

root 17573 1 TS 19 13:38 ? 00:00:01 - sr/www/tos/qni5
root 17592 1 TS 19 13:38 ? 00:00:00 - sr/www/tos/qni5

they have weird names such as fjjm0hnmumul

17573 root 20 0 0.3m 0.1m 0.0 0.0 0:01.51 S `- fjjm0hnmumul
17592 root 20 0 0.3m 0.1m 0.0 0.0 0:00.02 S `- fjjm0hnmumul

I tried to kill them and they just came back.

TM support could you tell ?

Br

@TMSupport I would appreciate some help there, to know whether these are normal processes from TOS or not.

[root@TNAS-002C6C /]# crontab -l
*/1 * * * * /var/nas/everyminuteexec
10 * * * * /var/nas/everyhourexec
20 0 * * * /var/nas/everydayexec
0 12 * * * ntpdate -b time-a.nist.gov
* * * * * /usr/www/tos/qni5 > /dev/null 2>&1 &
* * * * * /dev/shm/qni5 > /dev/null 2>&1 &
* * * * * /var/tmp/qni5 > /dev/null 2>&1 &
* * * * * /var/lock/qni5 > /dev/null 2>&1 &
* * * * * /var/run/qni5 > /dev/null 2>&1 &

Hi! Your machine has infected with virus, and you can follow the article below to remove the virus. viewtopic.php?f=71&t=2292&p=12383#p12383

Thanks @TMSupport for pointing out this procedure and especially the inittab that was missing from what I stopped yesterday.

Regarding the initial post and aaaaaa process, even if I stopped it long ago, I can see traces of it in errors returned by dmesg command:

[175420.235148] aaaaaaaaaaaa[31175]: segfault at 30373931 ip 0000000030373931 sp 00000000ffb9f460 error 14
[175420.235175] Code: Bad RIP value.
[177464.136631] aaaaaaaaaaaa[12274]: segfault at 8a50520 ip 000000000804a18c sp 00000000ffb6f460 error 4

Do you know if I should be worried about it, and how I can repair this?

FYI there are many of these most likely from the processes triggered by the pty/qni virus like this one I guess

qhfgbghhgw5s2mb[26337]: segfault at ffdf4729 ip 000000000804b635 sp 00000000ffde1d48 error 4 in i586[8048000+c000]
[169650.431940] Code: 21 00 00 83 c4 10 83 ec 0c 6a 00 e8 01 4e 00 00 8b 5d fc c9 c3 55 89 e5 83 ec 10 c7 45 fc 00 00 00 00 eb 03 ff 45 fc 8b 45 08 <8a> 00 84 c0 0f 95 c0 ff 45 08 84 c0 75 ec 8b 45 fc c9 c3 55 89 e5