I have a ReadyNAS 212 device with 2 6TB disks, for a total of 12TB of data. I just upgraded firmware to 6.9.5. I have a Windows 7 machine. I was just looking at the Logs and noticed 1 Trojan and 2 other infected files, but don't see how to delete the files. Here is what the Log says: Mar 15, 2019 11:34:42 AM System: Antivirus scanner found a threat ( Win.Trojan.Agent-1124515) in the file /root/.42/MITMf/libs/bdfactory/onionduke/OD_stub.exe. Please delete the infected file soon. Mar 15, 2019 11:15:59 AM System: Antivirus scanner found a threat ( Win.Exploit.CVE_2015_0005-1) in the file /usr/local/lib/python2.7/dist-packages/impacket/examples/ntlmrelayx/clients/smbrelayclient.py. Please delete the infected file soon. Mar 15, 2019 11:12:16 AM System: Antivirus scanner found a threat ( Win.Exploit.CVE_2015_0005-1) in the file /usr/local/bin/smbrelayx.py. Please delete the infected file soon. I cannot find how to get to the Root file to delete the Trojan, nor can I find my way to the other infected files. Any help would be much appreciated. Ericka

These are on the OS partition, so you would need to enable ssh, and delete them from the linux CLI. These aren't part of the normal NAS install, so you probably have installed some apps. Which ones?

I installed the Plex Media Server (for RN2xx) and VPN Server, but could easily delete those. The VPN Server isn't even enabled, and has never worked, anyway, so I think I'll just delete that. I don't have Linux on my machine, can you give me more details on how to delete these files? Sorry, but I'm really new to the server area. Thanks for the reply.

I just checked SSH and it is enabled, so if you could tell me how to delete the file, that would be great. Thanks.

Based on your logs, the file's name/path is `/root/.42/MITMf/libs/bdfactory/onionduke/OD_stub.exe`. The directory paths show that it could be related to a `backdoor-factory` and `man-in-the-middle-framework`. If these files are not something that you installed, you should be advised to remove the `/root/.42/MITMf` directory (or maybe the whole `/root/.42` depending on what other content is in there), since these are not files that is part of the OS.

OOM-9, could you possibly send me something that tells me exactly how to delete these files or directories, since I am unable to see them at all. I tried typing /root/... into my header field and am getting nowhere with trying to blindly bring up the file or folders. Like I said before, I am really new to servers and can't seem to get the "root" directory to show up when I log into the ReadyNAS server. Believe me, if I could see it, I would delete it. Thanks for any help you can provide.

Forum Discussion

kcejo

Tutor

Mar 15, 2019

OD_stub.exe Trojan Detected but Unable to Delete

I have a ReadyNAS 212 device with 2 6TB disks, for a total of 12TB of data. I just upgraded firmware to 6.9.5. I have a Windows 7 machine.

I was just looking at the Logs and noticed 1 Trojan and 2 other infected files, but don't see how to delete the files. Here is what the Log says:

Mar 15, 2019 11:34:42 AM		System: Antivirus scanner found a threat ( Win.Trojan.Agent-1124515) in the file /root/.42/MITMf/libs/bdfactory/onionduke/OD_stub.exe. Please delete the infected file soon.
Mar 15, 2019 11:15:59 AM		System: Antivirus scanner found a threat ( Win.Exploit.CVE_2015_0005-1) in the file /usr/local/lib/python2.7/dist-packages/impacket/examples/ntlmrelayx/clients/smbrelayclient.py. Please delete the infected file soon.
Mar 15, 2019 11:12:16 AM		System: Antivirus scanner found a threat ( Win.Exploit.CVE_2015_0005-1) in the file /usr/local/bin/smbrelayx.py. Please delete the infected file soon.

I cannot find how to get to the Root file to delete the Trojan, nor can I find my way to the other infected files. Any help would be much appreciated.

Ericka

25 Replies

Replies have been turned off for this discussion

StephenB
Guru - Experienced User
Mar 15, 2019
These are on the OS partition, so you would need to enable ssh, and delete them from the linux CLI.

These aren't part of the normal NAS install, so you probably have installed some apps. Which ones?
- kcejo
  Tutor
  Mar 15, 2019
  I installed the Plex Media Server (for RN2xx) and VPN Server, but could easily delete those. The VPN Server isn't even enabled, and has never worked, anyway, so I think I'll just delete that.
  
  I don't have Linux on my machine, can you give me more details on how to delete these files? Sorry, but I'm really new to the server area.
  
  Thanks for the reply.
  - kcejo
    Tutor
    Mar 15, 2019
    I just checked SSH and it is enabled, so if you could tell me how to delete the file, that would be great. Thanks.