Tech Support Help:Virus

Posted by: Woods Scot on 19 September 2012

I am hoping someone here can give me some technical advice on how to deal with a potential virus on my NAS drive (Lacie 2big NAS).

 

Here is the story. My nServe (SSD) recently started to act up. If the power would go out, it would get stuck in the "boot up cycle". I did send it back to the distributor here in Canada. At first they were not sure what they were looking for, and then determined that I had the win32/conflicker worm on my nServe. it was subsequently wiped clean

 

I found this curious as I rarely if ever use a USB device/memory drive, and never directly to my serve. Neither here nor there I guess. 

 

Once diagnosed, I scanned my drives, and ran the stinger app on my Macbook pro. I ran several other antivirus programs (Sophos and Kaspersky). On each scan of my macbook, usb's, external hard drive and my NAS public folder, there was no sign of the suspected virus. The nServe was returned, was connectde for about 6 days and not, after a power outage, it is once again stuck in the "boot up mode"

 

I am wondering if there is something I am missing. My nServe is once again stuck in the boot mode, indicating that the virus is still present; and has once again taken hold of the nServe.

 

Any suggestions?Is there a way to scan my NAS with the stinger app (McAfee), and how would I go about doing this.?How do I access my Lacie Root directory to scan it? I am a little frustrated at present and any help would be appreciated.

 

Step by step instructions would be great if anyone wants to take the time.

 

I am running OSX 10.8.1 on my MacBook pro, I have a Lacie 2big Network NAS that I am using to stream media (it is actually connected to my nServe via ethernet cable.)

 

Thank you in advance.

 

Scot Woods

 

Posted on: 19 September 2012 by garyi

It seems unlikley that it will be on the nserve but if it is I don't think its something you are going to be able to fix. Send it back to naim.

 

Lacie NASes use windows for its OS, but I could only find this detail for its 5gig product. Basically ensure that this is your issue. You are telling me that a tool designed to find the confliker worm failed to do so.

 

That kind of tells me that there is an issue not virus related on your nserve and that your dealer has given you erroneous information.

Posted on: 20 September 2012 by Lumos

Dear Scot,

 

Because the Naim Unitiserve does not run windows, even if there was a win32/conflicker worm physically on the SSD it would not be able to run and would just be data. Thus if the Unitiserve will not boot up without the Lacie attached then I think that there is a problem with the Unitiserve and Naim needs to fix it. 

 

Garyi, whilst I have no evidence to the contrary I have never heard of a NAS running windows as its own operating system and it would seem to me a very strange choice. What is your source? What is the boot time for a Lacie drive?

 

Ian

Posted on: 20 September 2012 by Claus-Thoegersen

Hi,

 

The other servers run  a special version of Windows xp, so I see no reason why the unityserve would not do it also. Since you can run asset upnp  on a few nas'es and it only runs on Windows some Nas version must do that also.

Not that any of this really matters to the posters problem.

 

Claus

 

Posted on: 20 September 2012 by Woods Scot
Thanks all. Most of this makes sense to me. As for my source : not sure what you are asking. The boot time on my Lacie is normal , that being the same as when I first bought it. (3 mins approx) Please all insure is welcome, not sure what to do next. Scot
Posted on: 20 September 2012 by Woods Scot

Anyone else? Naim HQ maybe?

Posted on: 20 September 2012 by Jan-Erik Nordoen

Hi Scot,

 

My UnitiServe also got stuck in boot mode this summer after a power outage and was repaired by the Canadian distributor (Plurison). The boot sector had been corrupted, but there was no mention of a virus. Are you sure that was the cause ? Your best bet is to contact Emmanuel LeQuéré at Plurison.

 

Jan

 

 

 

 

 

Posted on: 20 September 2012 by spartacus
Originally Posted by Claus-Thoegersen:

Hi,

 

The other servers run  a special version of Windows xp, so I see no reason why the unityserve would not do it also. Since you can run asset upnp  on a few nas'es and it only runs on Windows some Nas version must do that also.

Not that any of this really matters to the posters problem.

 

Claus

 

 

Claus, Not sure where you get this idea it has been stated that the Naim streamers don't use an underlying operations system. 

 

In addition my Qnap NAS runs an embedded version of Linux. I am not sure what LaCie OS 2 is based on. If the OP has searched the server and the NAS for viruses then it would exclude what his dealer said.

 

I agree that there may be a problem with boot process of the Nserve. Even if it boots from a disk boot sector or from firmware it sounds to me like Naim need to take a look at it. Probably best email Naim support directly and see what they say.

Posted on: 20 September 2012 by Woods Scot
I have contacted Plurison and they seem at a loss as there has been no reply. Still waiting on some insight....
Posted on: 20 September 2012 by spartacus

Ah.. Canada. Hope you get it fixed soon.

Posted on: 20 September 2012 by sktn77a
Originally Posted by Lumos:

Because the Naim Unitiserve does not run windows,


You sure about this?  The HDX has the windows operating system on the hard drive/SSD.

Posted on: 20 September 2012 by Manu
Each time we have got Scott's unitiserve it was infected by the conflicker virus. Stinger detected it and cleared it. We have done multiple tests at our office to be sure we were not the infectious agent. Norton detect this worm and we are under permanent protection. The second time, we have connected a USB drive to Scott's unit, it has been infected immediately, detected and cleaned when scanned by Norton. Apparently this virus attack the boot sector. So the vector is the unitiserve. When cleaned, we connect it to our network, full of PCs, Naim servers and other units, but under permanent supervision of Norton. No problems, so the Serve is Ok. We send it back and it gets reinfected when Scott connect it to his network. Our analysis is the worm resides in Scott's network. As he only has a Mac and a Nas and as Scott explained he has scanned the mac and shared folders of the Nas, we suspect the system folder of the NAS. Does someone know how to scan this folder? Scott, send me an email with the NAS ref, I'll call Lacie, maybe they can help. And please guys, do not be so affirmative when you have no clues (about OS for example). Unfortunately for Scott, he is right now a Ginea Pig, but he will be rewarded for his patience. But you all have to realize that in these cases Naim products are victims, not aggressors. We have no control on aggressors, so we have to find ways to better protect ourselves.
Posted on: 21 September 2012 by Lumos

In response to sktn77a and Manu.

 

My only direct piece of evidence to support my view is from Phil at Naim on this forum. Every time people vent that they cannot update Naim firmware via the internet Phil patiently explains that as Naim devices do not run an operating system updates require a new firmware install. As conflicker is closely associated with Windows an operating virus on a unitiserve would not be my first port of call. It is more likely to be a red herring rather than the cause.

 

There have been a number of cases of Unitiserves being caught in startup  loops but I am not aware of the conflicker virus ever having been identified as the cause.

 

Manu, I understand that you feel frustrated but you do not need to be rude to people on here who are trying to help and who just may know a thing a two of which they speak.

 

Ian

Posted on: 21 September 2012 by Phil Harris
Originally Posted by spartacus:
Originally Posted by Claus-Thoegersen:

Hi,

 

The other servers run  a special version of Windows xp, so I see no reason why the unityserve would not do it also. Since you can run asset upnp  on a few nas'es and it only runs on Windows some Nas version must do that also.

Not that any of this really matters to the posters problem.

 

Claus

 

 

Claus, Not sure where you get this idea it has been stated that the Naim streamers don't use an underlying operations system. 

 

In addition my Qnap NAS runs an embedded version of Linux. I am not sure what LaCie OS 2 is based on. If the OP has searched the server and the NAS for viruses then it would exclude what his dealer said.

 

I agree that there may be a problem with boot process of the Nserve. Even if it boots from a disk boot sector or from firmware it sounds to me like Naim need to take a look at it. Probably best email Naim support directly and see what they say.

 

Hi Claus,

 

The Naim Servers all use Windows XP Embedded - it is the Naim Streamers that don't have an underlying OS on their main boards.

 

The OP is in contact with the Canadian dealer and the Canadian dealer is in discussion with our software guys to resolve the issue so this is in progress...

 

Cheers

 

Phil

Posted on: 21 September 2012 by Phil Harris
Originally Posted by Lumos:

In response to sktn77a and Manu.

 

My only direct piece of evidence to support my view is from Phil at Naim on this forum. Every time people vent that they cannot update Naim firmware via the internet Phil patiently explains that as Naim devices do not run an operating system updates require a new firmware install. As conflicker is closely associated with Windows an operating virus on a unitiserve would not be my first port of call. It is more likely to be a red herring rather than the cause.

 

 

 

I patiently explain that the streamers do not run an underlying OS... 

 

 

Originally Posted by Lumos:

 

There have been a number of cases of Unitiserves being caught in startup  loops but I am not aware of the conflicker virus ever having been identified as the cause.

 

 

 

This is the ONLY instance of any serve being affected in this way - as part of our testing we do expose the servers to a "dirty suite" of memory sticks, CDs and network shares that are infected with the more virulent nasties and we have not been able to infect any of our products with any strain of virus here. Not saying that we're perfect but we do have the servers pretty well nailed down.  

 

 

Originally Posted by Lumos:

 

Manu, I understand that you feel frustrated but you do not need to be rude to people on here who are trying to help and who just may know a thing a two of which they speak.

 

 

 

Having met Manu on a number of occasions I'm sure he wasn't intending to be rude (he's a lovely fella in person) and when English in not your only or primary language then it is very easy to have what you written taken in a way that you didn't intend. (Hey, English is my ONLY language and I get that sometimes. )

 

Cheers

 

Phil

Posted on: 21 September 2012 by Lumos

It seems that I was wrong on all counts and I apologise to you all.

 

Ian

Posted on: 21 September 2012 by Phil Harris
Originally Posted by Lumos:

It seems that I was wrong on all counts and I apologise to you all.

 

Ian

 

No need for any apologies Ian - just want to make sure that the information that everyone is working with is correct.

 

Phil

Posted on: 21 September 2012 by Woods Scot

Thanks all. i am in contact currently with Manu, and we hope to have this resolved soon. I will post any answers/results , once I have something to post about.

 

I really appreciate all the input; another reason why the forum can be a great place.

 

Scot

Posted on: 21 September 2012 by Manu
Lumos It was not my intention to be rude, and it was not only addressed to you... Sorry Add to what Phil said that I felt important to post but it was about 1 AM...
Posted on: 21 September 2012 by Lumos

Dear Manu,

 

I have learned a lot from this thread, in particular that my three awesome Unitiserves run Windows XP embedded. Given that, it seems your line of investigation makes absolute sense and it is also clear that Scot is getting great customer support from you and from Naim. I think that the Unitiserve is a truly wonderful device and I hope that Scot will soon be enjoying his music again.

 

Sorry again to you personally,

 

Ian

Posted on: 21 September 2012 by Phil Harris

(Group hug)

 

Phil

Posted on: 21 September 2012 by spartacus
Originally Posted by Lumos:

 

 

I have learned a lot from this thread, in particular that my three awesome Unitiserves run Windows XP embedded. Given that, it seems your line of investigation makes absolute sense and it is also clear that Scot is getting great customer support from you and from Naim.

Yes completely agree. I have also learned that I need to update my Qnap to at least firmware version 3.5, I've read that this is where I get anti-virus on the NAS. I think we all forget that even if Macs are not affected much by viruses they can pass them on. If you have a mixed OS environment it looks like you need to virus protect them all, NAS, Mac and Windows.

 

Off to research virus protection for my NAS now.

 

Hope you get sorted soon Scott. It would also be worth posting back so that the forum can benefit from whatever the fix is. 

Posted on: 21 September 2012 by Jan-Erik Nordoen

It could have been worse (to the tune of Thunderstruck) :

 

http://www.newscientist.com/bl...-facilities-thu.html

Posted on: 21 September 2012 by Woods Scot

I guess it could have been worse and i will let everyone know how things develop over the coming days.

 

Scot

Posted on: 21 September 2012 by Bart

i also appreciated learning from Phil some of the steps that Naim go to to ward against such "nasties."  I am not surprised of course, but the details are interesting

Posted on: 27 September 2012 by spartacus
Originally Posted by Manu:
 Our analysis is the worm resides in Scott's network. As he only has a Mac and a Nas and as Scott explained he has scanned the mac and shared folders of the Nas, we suspect the system folder of the NAS. Does someone know how to scan this folder? Scott, send me an email with the NAS ref, I'll call Lacie, maybe they can help. And please guys, do not be so affirmative when you have no clues (about OS for example). Unfortunately for Scott, he is right now a Ginea Pig, but he will be rewarded for his patience. But you all have to realize that in these cases Naim products are victims, not aggressors. We have no control on aggressors, so we have to find ways to better protect ourselves.

 

Hi Manu and Scott, any progress on sorting this one out yet.

 

Based on this thread I looked into my own Qnap NAS and how to protect it. Yesterday I upgraded my NAS firmware and it now has virus scanning software included as an application. I ran a scan and it took 3 hours! I have now set up a scheduled job to run weekly but start at 02:00 in the morning.

 

This is because I would hate to borrow a piece of Naim kit running embedded windows XP and send it back to my dealer infected with a virus, plus the potential for then infecting my dealers network.