Forum Discussion

Tutor

Mar 15, 2019

OD_stub.exe Trojan Detected but Unable to Delete

I have a ReadyNAS 212 device with 2 6TB disks, for a total of 12TB of data. I just upgraded firmware to 6.9.5. I have a Windows 7 machine. I was just looking at the Logs and noticed 1 Trojan...

StephenB

Guru - Experienced User

Mar 15, 2019

These are on the OS partition, so you would need to enable ssh, and delete them from the linux CLI.

These aren't part of the normal NAS install, so you probably have installed some apps. Which ones?

kcejo

Tutor

Mar 15, 2019

I installed the Plex Media Server (for RN2xx) and VPN Server, but could easily delete those. The VPN Server isn't even enabled, and has never worked, anyway, so I think I'll just delete that.

I don't have Linux on my machine, can you give me more details on how to delete these files? Sorry, but I'm really new to the server area.

Thanks for the reply.

kcejo
Tutor
Mar 15, 2019
I just checked SSH and it is enabled, so if you could tell me how to delete the file, that would be great. Thanks.
- OOM-9
  NETGEAR Expert
  Mar 15, 2019
  Based on your logs, the file's name/path is `/root/.42/MITMf/libs/bdfactory/onionduke/OD_stub.exe`.
  
  The directory paths show that it could be related to a `backdoor-factory` and `man-in-the-middle-framework`. If these files are not something that you installed, you should be advised to remove the `/root/.42/MITMf` directory (or maybe the whole `/root/.42` depending on what other content is in there), since these are not files that is part of the OS.
  - kcejo
    Tutor
    Mar 15, 2019
    OOM-9, could you possibly send me something that tells me exactly how to delete these files or directories, since I am unable to see them at all. I tried typing /root/... into my header field and am getting nowhere with trying to blindly bring up the file or folders.
    
    Like I said before, I am really new to servers and can't seem to get the "root" directory to show up when I log into the ReadyNAS server. Believe me, if I could see it, I would delete it. Thanks for any help you can provide.