This topic has been marked solved and closed to new posts due to inactivity. We hope you'll join the conversation by posting to an open topic or starting a new one.
I updated to 6.6.1 today and shortly after that my Virus Scanner detected a bunch of files:
The First Message says my Storage is only 30% free, which is correct. The Next Message says it's only 5% free, which is false. I still have 4,24 TB of 13.63 TB available it says everywhere.
The Next few Messages I don't understand. There are Dangerous Files detected. Where can I delete this files in /tmp/... ? I can't find a tmp folder in my shares.
Mi Jan 18 2017 15:01:54 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-3243752ca9e31453cac0185403f9e606.tmp (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 15:01:48 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-7b71a12a9b85e57a8c14cb7cdc55fbcf.tmp (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 15:01:48 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-d24478adf926e5697003831eaed05fad.tmp (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 15:01:48 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-d6cfdbc0c1373b2c731179ff1cb5536a.tmp (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 15:01:47 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-f88c71c4aab23c7fa2ea72efe6a62276.tmp/zip.008 (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 15:01:46 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-16d882a7200b7a2b75551734234393e4.tmp/zip.000 (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 14:37:55 System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Heuristics.Broken.Executable) in der Datei /tmp/clamav-507da92e7bca77dbc9ca14a88a0c4415.tmp entdeckt. Löschen Sie die Datei, die vom Virus befallen ist. Mi Jan 18 2017 10:37:05 Volume: Es sind weniger als 5 % der Kapazität von media frei. Leistung auf Volume media hat sich verringert. Zur Verbesserung der Leistung müssen Sie die Kapazität erweitern. Mi Jan 18 2017 10:27:00 Volume: Es sind weniger als 30 % der Kapazität von media frei. NETGEAR empfiehlt, die Kapazität zur Aufrechterhaltung des aktuellen Leistungsniveaus zu erweitern. Die kontinuierlichen Sicherungs-Snapshots werden gelöscht, wenn der freie Speicherplatz des Volumes weniger als 5 % beträgt.
Try upgrading to 6.7 at the end of the week and let us know if it fixes it. We launched a hotfix for it to the systems but it requires a reboot after it applies -- that was readynasos 6.6.1+2
after a reboot and the installation of the update everything worked fine the last few days. No more 5% messages and the daily virus updates were installed correctly.
after a few days of silence it started again right now. First 20% free and shortly after that 30%. In this time I changed nothing. The Antivirus detection alerts are back again too.
Mon Jan 23 2017 14:11:02 System: Antivirus scanner found a threat (Heuristics.Broken.Executable) in the file /tmp/clamav-adff1f24c0bbc4e0eeb59c3dda5dffc7.tmp (deleted). Please delete the infected file soon if automatic delete setting is not enabled. Mon Jan 23 2017 14:10:55 System: Antivirus scanner found a threat (Heuristics.Broken.Executable) in the file /tmp/clamav-52688c412f91b358b0346de0f90f88a4.tmp (deleted). Please delete the infected file soon if automatic delete setting is not enabled. Mon Jan 23 2017 14:07:04 Volume: Less than 30% of volume media's capacity is free. NETGEAR recommends that you add capacity to maintain current performance levels. Continuous protection snapshots will be deleted when volume free space is less than 5%. Mon Jan 23 2017 11:07:27 Volume: Less than 20% of volume media's capacity is free. Performance on volume media will degrade if additional capacity is consumed. NETGEAR recommends that you add capacity to avoid performance degradation. Sun Jan 22 2017 15:39:50 System: Antivirus scanner definition file was updated to 57.22929. Sat Jan 21 2017 15:40:51 System: Antivirus scanner definition file was updated to 57.22923. Fri Jan 20 2017 15:26:29 System: Antivirus scanner definition file was updated to 57.22917.
Got 1000+ Virus warnings til now... readynas is still sending up to 10 mails per minute.
Di Jan 24 2017 9:39:09
System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Swf.Exploit.CVE_2016_4178-1) in der Datei /tmp/clamav-e0916b288087f774c1b281d6a428c3c4.tmp/nocomment.html (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist.
Di Jan 24 2017 9:39:03
System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Swf.Exploit.CVE_2016_4178-1) in der Datei /tmp/clamav-ca67c2e47e03f00044f40393a9c36399.tmp/nocomment.html (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist.
Di Jan 24 2017 9:38:55
System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Swf.Exploit.CVE_2016_4178-1) in der Datei /tmp/clamav-861e3c93068486b3fc7dffbfe7d35ec3.tmp/nocomment.html (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist.
Di Jan 24 2017 9:38:49
System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Swf.Exploit.CVE_2016_4178-1) in der Datei /tmp/clamav-0402e490e3f084f823cdd693f395e736.tmp/nocomment.html (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist.
Di Jan 24 2017 9:38:43
System: Der Virenschutzscanner hat eine Gefahr ({DetectType}:Swf.Exploit.CVE_2016_4178-1) in der Datei /tmp/clamav-7cf98f14f3fa9c44ae9b32799c7fa5e9.tmp/nocomment.html (deleted) entdeckt. Löschen Sie die Datei, die vom Virus befallen ist.
followed your instructions but shortly after the the reactivation of Antivirus, the messages started to come in again:
Thu Jan 26 2017 11:07:45 System: Antivirus scanner found a threat (Heuristics.Broken.Executable) in the file /tmp/clamav-a9644d6f9858afe8268856743cbb4294.tmp (deleted). Please delete the infected file soon if automatic delete setting is not enabled. Thu Jan 26 2017 11:07:40 System: Antivirus scanner found a threat (Heuristics.Broken.Executable) in the file /tmp/clamav-7e4ec20ad581164a2b1db43a68a80a61.tmp (deleted). Please delete the infected file soon if automatic delete setting is not enabled. Thu Jan 26 2017 8:16:35 System: Antivirus scanner definition file was updated to 57.22948. Thu Jan 26 2017 8:14:41 System: ReadyNASOS background service started. Thu Jan 26 2017 8:13:19 System: The system is rebooting.
Engineering has identified a cause for the issues reported on the community. The root cause is that ClamAV uses up the /tmp directory space when scanning files transferred over SAMBA. The symptom is especially acute in models that have small RAM and low CPU bandwidth.
A possible fix has been identified and is being tested.
There may be other issues. Engineering is still in the process of investigating.
NETGEAR may release a beta version of the software next week here on the community site.
I was having trouble disabling the AV scanner for the moment. There is a window of opportunity right after the system is rebooted where disabling the AV appears to work. A subsequent reboot shows the AV still disabled. I did this because the AV appears to be at the heart of a constellation of errors included failed network access to the shares for my users. The system behaves as if it is severly overtasked.
Disabling the AV has thus far alleviated my troubles with the NAS. I will update as soon as it becomes available.
It is worth noting that my SSH was also on and would not disable. Attempting to disable it immediately after the reboot resolved the issues for this service as well and I was able to disable it.
I am really starting to HATE these netgear boxes... Netgar updates causing much grief & aggervation .... since upgrading the box is so slow & cant access shared drives ... im gonna lose it + i had to turn off thge anti-virus
I'll agree it is disconcerting running without AV and it was incredibly annoying trying to troubleshoot around my active users. However, at this price point I haven't found anything else that does the job. Not for me anyways - not in the network environment I am embedded in. I have a massive IPS sitting on top of me that I have no control over. I have to work with-in their rules and across several layers of defense. Both ends are designed to treat each other as external networks. It is incredibly annoying but then again I don't have to manage that monster. All I have to do is keep my 2 itty bitty NAS units talking and accessible to the users (and on rare occasions accessible to Netgear admins). I'll take that deal.
I don't have many issues and this is only the second time in years that I've had trouble I couldn't fix in less than an hour. Most people appeared to update with out a problem. Curse our bad luck for being in the minority this time.
Then I will update and let you know how things go.
Of course, if I am understanding you correctly, your machine was still slow even after disabling the AV. If that is true then your situation seems different than mine so and my success or failure might not be a good measure for you. I suppose it is better than nothing.
Are you sure the AV disabled? With mine it would come back on after the next reboot but I eventually got it to stay off.
I guess I am the odd man out. A Friday update means I have all weekend to get things right again if there are problems with out users getting in the way.
I think Weds. is ideal. There's two days where development is available for early adopters, and you have some idea by the weekend on where the release stands.
For anyone run into the slowness issue after enabling AntiVirus in 6.6.1, here is a work-around before the beta or official firmware with the fix is available:
Turn on SSH service through the Admin Page and SSH into ReadyNAS
Remove or comment out the lines starting with OnAccessExcludePath in file /etc/clamav/clamd.conf, save it.
Restart the clamav by running this command: systemctl restart clamav-daemon
Note that this clamd.conf configuration file will be overwritten again if re-enabling Anti-Virus, so above steps need to be re-done in that case.
