Tech Support Help:Virus
Posted by: Woods Scot on 19 September 2012
I am hoping someone here can give me some technical advice on how to deal with a potential virus on my NAS drive (Lacie 2big NAS).
Here is the story. My nServe (SSD) recently started to act up. If the power would go out, it would get stuck in the "boot up cycle". I did send it back to the distributor here in Canada. At first they were not sure what they were looking for, and then determined that I had the win32/conflicker worm on my nServe. it was subsequently wiped clean
I found this curious as I rarely if ever use a USB device/memory drive, and never directly to my serve. Neither here nor there I guess.
Once diagnosed, I scanned my drives, and ran the stinger app on my Macbook pro. I ran several other antivirus programs (Sophos and Kaspersky). On each scan of my macbook, usb's, external hard drive and my NAS public folder, there was no sign of the suspected virus. The nServe was returned, was connectde for about 6 days and not, after a power outage, it is once again stuck in the "boot up mode"
I am wondering if there is something I am missing. My nServe is once again stuck in the boot mode, indicating that the virus is still present; and has once again taken hold of the nServe.
Any suggestions?Is there a way to scan my NAS with the stinger app (McAfee), and how would I go about doing this.?How do I access my Lacie Root directory to scan it? I am a little frustrated at present and any help would be appreciated.
Step by step instructions would be great if anyone wants to take the time.
I am running OSX 10.8.1 on my MacBook pro, I have a Lacie 2big Network NAS that I am using to stream media (it is actually connected to my nServe via ethernet cable.)
Thank you in advance.
Scot Woods
It seems unlikley that it will be on the nserve but if it is I don't think its something you are going to be able to fix. Send it back to naim.
Lacie NASes use windows for its OS, but I could only find this detail for its 5gig product. Basically ensure that this is your issue. You are telling me that a tool designed to find the confliker worm failed to do so.
That kind of tells me that there is an issue not virus related on your nserve and that your dealer has given you erroneous information.
Dear Scot,
Because the Naim Unitiserve does not run windows, even if there was a win32/conflicker worm physically on the SSD it would not be able to run and would just be data. Thus if the Unitiserve will not boot up without the Lacie attached then I think that there is a problem with the Unitiserve and Naim needs to fix it.
Garyi, whilst I have no evidence to the contrary I have never heard of a NAS running windows as its own operating system and it would seem to me a very strange choice. What is your source? What is the boot time for a Lacie drive?
Ian
Hi,
The other servers run a special version of Windows xp, so I see no reason why the unityserve would not do it also. Since you can run asset upnp on a few nas'es and it only runs on Windows some Nas version must do that also.
Not that any of this really matters to the posters problem.
Claus
Anyone else? Naim HQ maybe?
Hi Scot,
My UnitiServe also got stuck in boot mode this summer after a power outage and was repaired by the Canadian distributor (Plurison). The boot sector had been corrupted, but there was no mention of a virus. Are you sure that was the cause ? Your best bet is to contact Emmanuel LeQuéré at Plurison.
Jan
Hi,
The other servers run a special version of Windows xp, so I see no reason why the unityserve would not do it also. Since you can run asset upnp on a few nas'es and it only runs on Windows some Nas version must do that also.
Not that any of this really matters to the posters problem.
Claus
Claus, Not sure where you get this idea it has been stated that the Naim streamers don't use an underlying operations system.
In addition my Qnap NAS runs an embedded version of Linux. I am not sure what LaCie OS 2 is based on. If the OP has searched the server and the NAS for viruses then it would exclude what his dealer said.
I agree that there may be a problem with boot process of the Nserve. Even if it boots from a disk boot sector or from firmware it sounds to me like Naim need to take a look at it. Probably best email Naim support directly and see what they say.
Ah.. Canada. Hope you get it fixed soon.
Because the Naim Unitiserve does not run windows,
You sure about this? The HDX has the windows operating system on the hard drive/SSD.
In response to sktn77a and Manu.
My only direct piece of evidence to support my view is from Phil at Naim on this forum. Every time people vent that they cannot update Naim firmware via the internet Phil patiently explains that as Naim devices do not run an operating system updates require a new firmware install. As conflicker is closely associated with Windows an operating virus on a unitiserve would not be my first port of call. It is more likely to be a red herring rather than the cause.
There have been a number of cases of Unitiserves being caught in startup loops but I am not aware of the conflicker virus ever having been identified as the cause.
Manu, I understand that you feel frustrated but you do not need to be rude to people on here who are trying to help and who just may know a thing a two of which they speak.
Ian
Hi,
The other servers run a special version of Windows xp, so I see no reason why the unityserve would not do it also. Since you can run asset upnp on a few nas'es and it only runs on Windows some Nas version must do that also.
Not that any of this really matters to the posters problem.
Claus
Claus, Not sure where you get this idea it has been stated that the Naim streamers don't use an underlying operations system.
In addition my Qnap NAS runs an embedded version of Linux. I am not sure what LaCie OS 2 is based on. If the OP has searched the server and the NAS for viruses then it would exclude what his dealer said.
I agree that there may be a problem with boot process of the Nserve. Even if it boots from a disk boot sector or from firmware it sounds to me like Naim need to take a look at it. Probably best email Naim support directly and see what they say.
Hi Claus,
The Naim Servers all use Windows XP Embedded - it is the Naim Streamers that don't have an underlying OS on their main boards.
The OP is in contact with the Canadian dealer and the Canadian dealer is in discussion with our software guys to resolve the issue so this is in progress...
Cheers
Phil
In response to sktn77a and Manu.
My only direct piece of evidence to support my view is from Phil at Naim on this forum. Every time people vent that they cannot update Naim firmware via the internet Phil patiently explains that as Naim devices do not run an operating system updates require a new firmware install. As conflicker is closely associated with Windows an operating virus on a unitiserve would not be my first port of call. It is more likely to be a red herring rather than the cause.
I patiently explain that the streamers do not run an underlying OS...
There have been a number of cases of Unitiserves being caught in startup loops but I am not aware of the conflicker virus ever having been identified as the cause.
This is the ONLY instance of any serve being affected in this way - as part of our testing we do expose the servers to a "dirty suite" of memory sticks, CDs and network shares that are infected with the more virulent nasties and we have not been able to infect any of our products with any strain of virus here. Not saying that we're perfect but we do have the servers pretty well nailed down.
Manu, I understand that you feel frustrated but you do not need to be rude to people on here who are trying to help and who just may know a thing a two of which they speak.
Having met Manu on a number of occasions I'm sure he wasn't intending to be rude (he's a lovely fella in person) and when English in not your only or primary language then it is very easy to have what you written taken in a way that you didn't intend. (Hey, English is my ONLY language and I get that sometimes. )
Cheers
Phil
It seems that I was wrong on all counts and I apologise to you all.
Ian
It seems that I was wrong on all counts and I apologise to you all.
Ian
No need for any apologies Ian - just want to make sure that the information that everyone is working with is correct.
Phil
Thanks all. i am in contact currently with Manu, and we hope to have this resolved soon. I will post any answers/results , once I have something to post about.
I really appreciate all the input; another reason why the forum can be a great place.
Scot
Dear Manu,
I have learned a lot from this thread, in particular that my three awesome Unitiserves run Windows XP embedded. Given that, it seems your line of investigation makes absolute sense and it is also clear that Scot is getting great customer support from you and from Naim. I think that the Unitiserve is a truly wonderful device and I hope that Scot will soon be enjoying his music again.
Sorry again to you personally,
Ian
(Group hug)
Phil
I have learned a lot from this thread, in particular that my three awesome Unitiserves run Windows XP embedded. Given that, it seems your line of investigation makes absolute sense and it is also clear that Scot is getting great customer support from you and from Naim.
Yes completely agree. I have also learned that I need to update my Qnap to at least firmware version 3.5, I've read that this is where I get anti-virus on the NAS. I think we all forget that even if Macs are not affected much by viruses they can pass them on. If you have a mixed OS environment it looks like you need to virus protect them all, NAS, Mac and Windows.
Off to research virus protection for my NAS now.
Hope you get sorted soon Scott. It would also be worth posting back so that the forum can benefit from whatever the fix is.
It could have been worse (to the tune of Thunderstruck) :
I guess it could have been worse and i will let everyone know how things develop over the coming days.
Scot
i also appreciated learning from Phil some of the steps that Naim go to to ward against such "nasties." I am not surprised of course, but the details are interesting
Hi Manu and Scott, any progress on sorting this one out yet.
Based on this thread I looked into my own Qnap NAS and how to protect it. Yesterday I upgraded my NAS firmware and it now has virus scanning software included as an application. I ran a scan and it took 3 hours! I have now set up a scheduled job to run weekly but start at 02:00 in the morning.
This is because I would hate to borrow a piece of Naim kit running embedded windows XP and send it back to my dealer infected with a virus, plus the potential for then infecting my dealers network.