autre exemple (désolé pas le temp de trad)
Method1
Install Malware Remover from APP Center and run it manually;
Connect nas over ssh
Use the command below to find if ransomware is still in progress.
Code:
cp `getcfg MalwareRemover Install_Path -f /etc/config/qpkg.conf`/7z.log /share/Public
If command back ‘No such file or directory’ means the NAS has been rebooted or encryption process has finished,
if that is the case, unfortunately there is nothing that can be done to help;
If command has been executed without issue, you can see 7z.log in NAS at the Public folder, which will include password;
Password will look like bellow:
a -mx=0 -sdel -pmFyBIvp55M46kSxxxxxYv4EIhx7rlTD [FOLDER PATH]
mFyBIvp55M46kSxxxxxYv4EIhx7rlTD is password
You can reboot NAS and use the password to decrypt the files;
If you don’t know how to read the password, please, you may send to QNAP Support the complete message with the NAS diagnostic log.
Method2
Connect NAS over ssh;
https://www.qnap.com/en/how-to/knowledge-base/article/how-to-access-qnap-nas-by-ssh
Use the command below to find out if ransomware is still in progress.
If there is no 7z, it means the NAS has been rebooted or the encryption process has been finished, if that is the case, unfortunately there is nothing that can be done to help;
If 7z is running, copy/paste command below and press enter(1 line)
Code:
cd /usr/local/sbin; printf '#!/bin/sh \necho $@\necho $@>>/mnt/HDA_ROOT/7z.log\nsleep 60000' > 7z.sh; chmod +x 7z.sh; mv 7z 7z.bak; mv 7z.sh 7z;
Wait a couple minutes to use cat to grep password;
It will look like bellow:
Code:
a -mx=0 -sdel -pmFyBIvp55M46kSxxxxxYv4EIhx7rlTD [FOLDER PATH]
mFyBIvp55M46kSxxxxxYv4EIhx7rlTD is password
You can reboot NAS and use the password to decrypt the files;
If you don’t know how to read the password, please, you may send to QNAP Support the complete message with the NAS diagnostic log.
