TS-231P Malware Remover problems (possible Workaround)

[nuked]

This just started up a few weeks ago... My NAS suddenly vanishes from the network because it becomes "busy" (drive lights blinking away and I can hear the drives quietly working away). The device hasn't crashed so to say, but it's so busy it won't respond to anything (can't raise the webpage, can't access the shares (I can't really confirm other things like the media server as I use my NAS as a Sync server - it's single function is to keep files synced between my desktop and notebook). I have to force power it down, wait a few minutes and power it back up and it fine for about a week. The logs always show the Malware scanner running as the last thing it was doing, then I see the forced shutdown, then the powering back up of the device and the checks. I have pulled the drives and run manual checks to ensure they are good (SMART data looks healthy (yes I know not to trust that), I've verified the data on them is good and free of corruption, and have performed a manual surface scan of the drives from my desktop). Anyone else experiencing a problem like this??

[kb1health]

Have been having similar issue.

Like you I've been doing a hard shut down (pull the power plug) and reconnect. One thing that slowed this condition, I've add the "Security Counselor" app and run the maleware and anti-virus features under that app. I've had malware and anti-virus running on a schedule before, but for some reason this condition slowed down after I ran them under "Security Counselor". Slowed down means maybe once since I added "Security Counselor" about 3 weeks ago.

Another thing to investigate, that I was having an issue with, is that the device was using a lot of RAM. I was generally seeing the RAM usage at about 80% - 90%, with CPU at about the same. After I added "Security Counselor" RAM usage drop to between 20% and 60% and CPU is down to about 4% normally and maybe 60% during load. I didn't remove any additional apps, just added "Security Counselor".

I honestly don't believe this is a Malware issue. If it is malware, its QTS impaled. I've manually updated "Maleware Remover" and run it. The app runs for at most 3 sec and reports no problem. The anti-virus runs much longer. I have 4TB Drives in RAID 1 and it takes about 2.5 hrs to complete, which I expect.

Continue to share your results. I hope that this issue doesn't follow as I migrate to TS-253D.

[nuked]

I know it's not malware in the files - but it seems like it's the Malware scanner they integrated into the current QTS OS that's acting up...Unless the log isn't catching something. Never had to pull the plug, just press and hold the power button (for what seems entirely too long) and it beeps and shutdown on it's own.

Mine's less fancy - only got two 1tb WD drives (no worry, I've checked and double and triple checked they are indeed CMR drives when the SMR scandal hit - I managed to dodge that). Then I have a rotation of cheap 1tb Seagates that I use for daily backup (also CMR (PMR in Seagate speak), but these are plain jane bare 7200rpm desktop drives that I slot into the HDD dock that I leave attached to the NAS - they don't get heavy use beyond each one performing one daily backup per week - very well within the MTBF ratings). I do have this on a 950VAC UPS (shared with my router, smart switch, and AP).

And yes, RAM usage always seemed to be high from when I first got the device a couple years ago (esp. given that I've turned off all the additional features not needed for my use case). I don't think this is a RAM usage issue (generally sits around 70% until "optimized") as it was last night I was looking through the logs. And it was this morning I found it in this state yet again (like last weekend, then the week before though it wasn't on a weekend).

Quite the annoying issue. :-/

[kb1health]

yo Nuked...... The fact that you have a NAS says you're fancy or Mr. Geek

I'm going to submit a ticket.... QNAP support just stakes so long I thought I would try a fix myself first. Best to you.

[nuked]

LOL Yea, Mr. Geek sounds right.

Anyways, I should prob do the same... I think I'm still in warranty... Maybe - should doubly check that.

Take Care!

[nuked]

And turns out I'm out of warranty by a few months... Darn it. But I found a whole ton of posts of people having problems with 4.5 series firmware causing multiple issues including problems that have the same symptoms over on Redit. Great... Hopefully QNAP gets these firmware problems sorted out & quickly (esp. since this is a regular firmware and *NOT* a firmware from the Beta branch).

Seems the most popular solution is to roll back the firmware to the last 4.4 series, and yes I was tempted to do that but I figure I might as well explore other options.

In this case, I picked a time when the NAS should not be in use and setup a daily reboot schedule. I've picked 4:00am, which is exactly one hour after the Malware Scanner runs. Yea, this should not need to be done, but it's safer then letting it crash out. Seems to be working, but I'll know best next week.

[redantpile]

I am having exactly the same problem. Will not respond to Putty or the Qfinder program. The web login does come up after about 5 minutes. Then I login and wait another 5 minutes. Either it never responds or will reply login credentials no longer valid. Cutting the power is the only way to get it back to normal.

If I am reading my log files correctly, the last thing mine did before it went haywire was CloudDriveSync. I'm going to set my Dropbox sync to manual. My system does not show a malware scan previous to the issue. I'm not an expert though so not for sure if I am seeing all of the relevant logs.

TS-231P running current firmware and raid 1

[nuked]

Yea -I'm not 100% convinced the Malware Remover is the actual cause - it's just an app that happens to be scheduled to run on mine before it crashes out. But it's all I've got to go on according to the logs. My gut feeling is there is a massive memory leak in the 4.5 firmware series that isn't being caught and/or being handled gracefully.

If you want to give an automated daily reboot a shot, that can be setup through the control panel's power settings (the power schedule tab).

Maybe I should enable the ssh server and investigate, but I'm far removed form being a Linux command line person. I do okay when I have Midnight Commander, but I'm not up to going through all the hoops in getting that running on my NAS...

[dawsonkm]

A lot of people are having problems with 4.5.1 firmware. I would roll back to a 4.4.x till it’s better. You can see all the posts with problems

[glommy]

I am so glad someone posted about this. I am having exact same problems with my TS-231P - thought I was going crazy.

I have run this thing for many months without problems. As soon as I updated to 4.5.1.x my TS-231P started becoming very unstable. It would run for a few days and then one night after a malware run it would become completely unresponsive. I would get notifications before it had completely croaked that the network interfaces were offline (always amused me, because how was it emailing me!), and I would also get notifications saying my UPS was unplugged, then plugged in, then unplugged... etc. The only thing to bring it back being pulling the power cable. I updated from 4.5.1.??? (whatever the first 4.5.1 build was - seems like they pulled it from their download page) to 4.5.1.1456 like 2 weeks ago and it made the NAS last a little longer, but this morning same exact problem.

I just pulled the power plug, got it back up and running, and am reverting to 4.4.3.1439. We shall see how that works.

I always suspected this was the malware software, but it didn't quite seem right. I suspect this is a more insidious firmware-hardware incompatibility with TS-231P when they updated tp 4.5.1.x. Hope they figure it out eventually because I will be hesitant to ever update firmware again on this thing.

[glommy]

... and on another note. I have a 1273AU-RP running 4.5.1.1465 - have people reported this problem on other models? Do I need to revert this system as well?

[nuked]

Can't say for sure, but most messages I seen seem to revolve around the cost effective units (so low/non-upgradable memory units with ARM based processors). I just own this one NAS (well, not quite true - I still have the NAS this one replaced, but it's very-very-VERY old ("Prehistoric" - LOL) and not made by QNAP).

Pulled up the data - wow, that's a beefy NAS. 8GB RAM, 12 bays, dual 2.5gb connectivity, PCIe M2, Ryzen CPU. I hope it's not effected by this problem, but I really don't know. If anything, I can't say I've seen anyone with that big of a NAS in the messages.

Qnap did release 4.5.1.1480... I'm hesitant to give that a shot until I have more free time.

[nuked]

Just for thoroughness and trying to keep info together, found another post for the TS-231P in the Miscellaneous forum regarding the same issues on the same series of firmware.

viewtopic.php?f=50&t=157924

[Tollman]

Any QNAP NAS with an ARM processor becomes paralyzed when an antivirus scan runs under security counselor

Have a look at

https://www.qnap.com/en/how-to/faq/arti ... efinitions

If you are sure that the files going onto the NAS are backups of your (virus-scanned) computer then it may be safe to disable the QNAP virus scan (which is in fact ClamAV the an open source anti-virus engine)

The symptoms of 90% RAM usage and extremely slow operation, for example login to QTS, are resolved by disabling the antivirus

Other scans also have an impact on performance/speed but the antivirus is the killer...

[nuked]

I do not have security counselor installed (never did & never will as I don't want or need an "advisor" app), and the antivirus from control panel is not activated (again, never has been or ever will be enabled - it's useless for the documents my NAS holds).

As for the Malware Remover app, there is no way to remove it or prevent it from running (not even with the old 4.4.3 firmware), much like how smart phone's arrive out of box with pre-loaded [stuff] that one can't (easily) remove or disabled... I'm going to assume it's just another component of CalmAV, but it's a component that cannot be disabled.

Versions 4.5.1.1456 through 4.5.1.1495 have all been problematic for the problem I was experiencing (for emphasis - no security center, Antivirus disabled). On those older 4.5.1 versions I was able to negate the issue somewhat by setting up a scheduled daily reboot (the "possible workaround"), but I did notice other symptoms of problems brewing. The usual high ram/swap usage that climbs the longer the NAS is on, extremely slow transfer rates, inability to see anything in the app center. Again I feel a need to really stress this point: no security counselor installed and the antivirus in control panel disabled. So the only real fix was downgrade to 4.4.3.1421.

The current 4.5.1.1540 seems to be okay so far. Yes memory usage is up when compared to 4.4.3.1421, but it's not exhibiting any symptoms of problems brewing at present time (and nope, no security center, Antivirus is disabled). It's also only been three days since I decided to give it a try - I'm not prepaired to say this problem doesn't exist in this firmware at this time.