TerraMaster Forum

I went to transfer some media to my NAS and I seen that there was readme files everywhere and all my media had been renamed. They all say ifire in there file names. I rebooted the NAS and now I can't even connect to it. I have not installed anything for ran any unsafe programs. The unit was working fine yesterday. Does anyone have any idea why this happened and how to fix my media?


The readme say
********************Your network has been infected!!!********************

IMPORTANT : DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED!!!

All your important files have been encrypted. Any attempts to restore your files with thrid-party software will be fatal for your files! Restore your data posible only buying private key from us. We have also downloaded a lot of private data from your network. If you do not contact us in a 5 days, we will post information about your breach on our public news webs.

You should get more information on our page, which is located in a Tor hidden network.
1.Download Tor browser - https://www.torproject.org/
2.Install Tor browser
3.Open link in Tor browser : aanb3upavmp5shyt6tw46owirfca65uba5f2re36hsacdehhyklmykyd.onion
4.Follow the instructions on this page

Your account on our website
*************************************************************************
username: ?
password:

ATTENTION:
1.Do not try to recover files yourself, this process can damage your data and recovery will become impossible.
2.Do not waste time trying to find the solution on the internet. The longer you wait, the higher will become the decryption key price.
3.Tor Browser may be blocked in your country or corporate network. Use Tor Browser over VPN.

Please shut down your TNAS first to stop the encryption program, then you can contact our technical team for a remote inspection.

This looks like it is another malware variant... "IceFire"?

https://twitter.com/malwrhunterteam/sta ... 3406345224

what is your system version? do you configure your device by following the guideline?

I have shut my NAS down. I'm using the OS provided by Terra Master. I'm only running a single 16tb drive. How do I find the system version?

You need to reinstall the system to prevent viruses from continuing to attack your device, more information.

You can find the TOS version in the login page.

I can't even get to the login page. The browser says connection refused. I can use the Terra Master pc program and see the device. I can even get the folders and files to show that way.

Is there a tutorial on how to update my TOS without losing all my stuff?

Hi, please follow this guide to reinstall your system: viewtopic.php?f=76&t=423

Would it be safe for me to hook the NAS drive up to my Windows system? I want to see how many files are damaged. What is TOS built from?

Thanks