Ransomware Devos Virus on Netgear NAS RN2120

[Asif_Sirajuddin]

hi all

today a ransomware attack happen on my nas and all files are encrypted all file extension are change to same as attached.

is there any solution for this to remove.

i dont get any error msgs etc. it is just a new morning we all came to office and we see this... please suggest any solutions if anyone have

happy to see fast response. 

regards,

[Sandshark]

It is unlikely your NAS was attacked, as I am unaware of a Linux variant.  More likely, a PC on your network and with the NAS mapped as a drive, was attacked and that link allowed the virus on the PC to encrypt the files on the NAS.  Do you have snapshots enabled on the NAS?  If so, stop them now, before the last good snapshot is deleted to conserve space.  Then, once you have cleared all the computers, you can restore from snapshot.  Unfortunately, with so many files changed, the NAS may have already deleted snapshots to make room.

There are a couple of decryptors out there for Devos, but I have not tried them.

This is one of those cases where you really should have a backup, too.  And that backup device should not be available to the PCs, if possible.  My primary backup is another NAS with only Rsync enabled.

[Asif_Sirajuddin]

Thank you for your response. actually snapshot is available but not for all share folder specially main our data folder doesn't have.

as you mentioned there is couple of decrypters available. can you share their details? 

[Sandshark]

I know nothing about the decryptors except what I have Googled.  I suggest you do the same.