QNAP NAS - IT Ransomware

S1000RR  FORUM

Help Support S1000RR FORUM:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.

alex

Forum Moderator
Staff member
Admin
Moderator
Joined
Apr 29, 2014
Messages
12,322
Reaction score
45
Location
London and Norfolk
If any of you are using a QNAP device for storing photo's, films and other data then please stop what you're doing and go and run the latest malware remover on it.
If you don't know what a QNAP is don't worry this post isn't for you.
My NAS (Network Attached Storage) is now f**ked as I shut it down the moment I realised it was compromised, which was the wrong thing to do.
At worst we've lost some holiday photo's which is shit but ultimately not going to end the world...because there's no way I'm paying the ransom.

https://www.theregister.com/2021/04/22/qnap_nas_ransomware_qlocker_ech0raix/
https://www.qnap.com/en/how-to/faq/...o-when-found-nas-is-encrypting-my-files-by-7z


Applied models:


All NAS Series
Applied Firmware:


All QTS Firmware Versions


Answer
MUST NOT Shutdown NAS and follow the steps below:


If you have internet:
Install Malware Remover from app center
Start Scan immediately
Contact QNAP support ASAP

If you don?t have internet:
Connect to your NAS via SSH: How to access nas over ssh
Download this file to your PC and upload it to your NAS Public folder: http://download.qnap.com/Storage/tsd/utility/7z
Copy and paste commands below:
cd /usr/local/sbin
rm /usr/local/sbin/7z
cp /share/Public/7z /usr/local/sbin
chmod 755 /usr/local/sbin/7z
Contact QNAP support ASAP
 
Back
Top