XPEnology - Virus and damaged permissions

[nick w]

Is anyone able to help me

 

So i followed this simple guide on the 4.3 virus thread:

What I did (for other people having issues, its already described in parts in this thread, but again:)

- Download the DSM 4.3-3810 v4 package from Trantor (see first post).

- Unzip it (Mac: Stuffit Expander, Windows: WinRAR)

- Make a directory on volume 1, called 'public' (as described)

You can do this with SSH or in the GUI

SSH: mkdir /volume1/public

GUI: >ControlCenter >SharedFolders >Create (name it public, give at least the admin read/write permissions)

- Copy the files 'autoupd@te.info' (<- thats a file) and '@smallupd@te.deb' (<- thats a folder) to /volume1/public by afp (or ftp) (just simply drag and drop it)

Mac: Use AFP, Windows: use FTP

- Move the files to their new location.

CODE: SELECT ALL

cp /volume1/public/autoupd@te.info /

cp -a /volume1/public/@smallupd@te_deb/ /volume1/

 

- DISCONNECT YOUR ROUTER (or switch) FROM THE INTERNET

- REBOOT THE NAS

You can do this with the SSH or in the GUI

SSH: reboot

GUI: >reboot

 

- Use the GUI: go to >ControlPanel >DSMUpdate

- Click 'manual update'

- Click 'cancel'

(Now you need to see the 'update now' button)

- Click that button

 

I even had to sort these files out:

Successfully stopped all process called lolzm, lolzb, synolog (killall lolzm lolzb synolog)

Successfully deleted S99p.sh (main script that start 'lolzm' 'lolzb' and 'synolog' when booting)

Successfully located and deleted the /lolz folder and its contents.

Successfully deleted /opt/bin (where some modified versions of ls kill top ps where located)

Successfully deleted /etc/ld.so.preload

These steps below didnt seem to help so i had to revert these changes

Successfully moved /usr/syno/synoman/webman/modules/ControlPanel/modules/upgrade2.cgi

Successfully moved /usr/syno/synoman/webman/modules/ResourceMonitor/rsrcmonitor3.cgi

Successfully moved /usr/syno/synoman/webman/modules/ResourceMonitor/top2.cgi

 

 

It looks like i got the LOL virus, and now i am struggling to update

I have follow the guide to the T, but when i get to the update screen, i cant for the life of me get the update button.

 

Its getting to the point where im thinking of buying 2x 4tb drives to migrate off, to re-install DSM 4.3 to then migrate back....

 

Still my resource monitor is broken, think thats from the LOL Virus

Now when i click updateDSM in control panel, it says no internet connected, you select ok, then the update window goes.

 

BAD TIMES

 

Any help, i would be happy to throw some beer tokens your way!

 

 

 

NOW,

Do i attempt to solve it (would mean some kind people posting up some ideas on fixing it)

 

Copy all the data off to another 8th and rebuild the current volume?

 

Try to upgrade to 4.3 and migrate. I assume there is a risk of losing my data?

 

Thanks

N

[j911]

Can you use something like winscp to ftp/ scp into your DSM? If so build a new DSM VM and copy the above mentioned files over to the infected DSM. This should overwrite any modified scripts. Alternatively try running a reset to defaults after backing up your configuration. you shouldn't lose any data by doing so just any apps you had installed.

 

Also check the update script thread on how to manually delete the update if you get that message for no internet.

 

Sorry I can't be of much further use. Hope you get it sorted

[nick w]

Can you use something like winscp to ftp/ scp into your DSM? If so build a new DSM VM and copy the above mentioned files over to the infected DSM. This should overwrite any modified scripts. Alternatively try running a reset to defaults after backing up your configuration. you shouldn't lose any data by doing so just any apps you had installed.

 

Also check the update script thread on how to manually delete the update if you get that message for no internet.

 

Sorry I can't be of much further use. Hope you get it sorted

 

That is a great idea.

 

The reset to default button scares me, so i have ordered 2x 4tb drives to back up my current data. Then will attempt a restore.

Thanks for the idea!