In the early Sunday morning of August 3, 2014, a tweet by Mike Evangelist was linked on Hacker News.
Lovely. My @Synology NAS has been hacked by ransomware calling itself Synolocker. Not what I wanted to do today. pic.twitter.com/YJ1VLeKqfY
I was somewhat scared by this news as some users at Synology forums reported that they were also victims of SynoLocker which is a CryptoLocker malware which specifically targets Synology NAS. I am managing numbers of Synology NAS for a few small offices and homes. Granted that none of them are directly connected to the Internet, but I have to make sure none of them would be hacked and crypto-locked.
Make sure your Synology NAS is running the latest DSM Operating System.
For now, disable the QuickConnect service.
Disable all port-forwarding if your Synology DiskStation is behind a NAT Firewall. This is a definite inconvenience; better to be safe than sorry.
More importantly, back-up the content of your Synology NAS. Should anything happen, you still have your data. My colleague has a great advice on backing up:
As always, if you have data on your Synology that you consider irreplaceable, make sure that you have it backed up to. I’d recommend using the built in Amazon S3 client. It’s cheap and fairly easy to set up, and should help you in case of a disaster.
I personally also run a backup to another hard drive locally for rapid recovery.
Malware comes with interesting way to deceive users that they are not malicious in any ways. This particular malware has a peculiar icon which looks like a folder marked “ENLISTED” and photo of U.S. Marine.
This particular malware bears filename of “svc-mdek.exe” which is classified as “Rogue.WindowsExpert” by MalwareBytes Anti-Malware.
I think we need more toolbars on this Google Chrome.
Use the following tools to scan and clean your Windows computer.
I have not installed DivX for years, and I now remember why; DIVX Installer includes Conduit Search.
If you had Conduit Search present on your computer, you want to remove it. Then use the following tools to scan and clean your computer.
For the past week I have been removing a lot of Malware from a lot of computers running Windows XP, Windows Vista, Windows 7 and Windows 8. Some are harder to remove than the others. In general I’d like to avoid the Scorched-Earth scenario whenever possible, as it is the last resort.
There are a lot of ways to remove Malware, there is not a single solution.
Whenever removing Malware from Windows computers I tend to boot to Safe mode with a Command prompt and remove any Malware reference from “Run” key in the registry and Start from Programs Menu.
Some tools/programs that I use:
I then use Microsoft’s Malicious Software Removal Tool and Safety Scanner to for the second run of Malware removal.
There are a lot of other tools/programs that I use to remove the Malware whenever necessary.
Another day, another computer infested with malware.
Potentially Unwanted Programs (PUP) identified here:
- Starter (DriverGenius)