Can not access qnap gui on LAN

[dolbyman]

best to ask this question with the source of the program

rule of thumb .. if your windows computer can run it .. it will probably NOT run on your NAS (different OS)

[Krssubbu1]

I can’t thank enough to you, dolbyman for suggestions

It’s helped me a lot to remove. Quick question how is copy the file to root and run?

Thanks

[dolbyman]

use something like this

https://winscp.net/eng/index.php

[krssubbu2]

Dolbyman,
I cant thank you enough for this.

I lost my qnap support forum and couldnt login so had to create another account

I ran as per process on bleepingcomputer (I had my private key in there - thanks to whoever posted in that)

I ran it few times on every folder but couldnt run it on Root folder as it kept complaining no space even though there is!

I can access my files through SMB but

a. still not able to access the page over GUI even on LAN. when i try to access over LAN, I get security warning and then when i accept the risk i get redirect to QTS.cgi download option?
b. not able to access the page over web (myqnapcloud)
c. how to i make sure the ransomeware is removed and I can access the gui over LAN?


Thanks,

[dolbyman]

a. best thing to do is to kill the NAS (including DOM) and start from scratch restoring from backups
b. good, make sure it is never accessible that way anymore
c. see a.

[krssubbu2]

I do not have any backups which is the issue. can i just copy the stuff what i want to and kill the NAS and start from scratch?

if yes can i just move the data from this NAS to another one?

how do i erase qnap nas?

[dolbyman]

you can attach an usb drive and just copy the stuff over, either via shell or winscp

[Krssubbu1]

Thank you, I don't have a hard drive for 3 TB. I do have another NAS. I can I connect these back to back and copy over? what is the command line for this? cp *.* (ip_of_new_nas)?

Also how do I erase the qNAP? if I don't find the .musthik extension that means data is safe?

Sorry qnap is of NO help and keep resolving my ticket even though they have not provided me the answers

[dolbyman]

go to a store and buy a 3TB+ drive .. use it for backups after

absence of encrypted files does not mean the absence of the crypto infection.. it could be dormant and checking for new C&C instructions .. unknown