MissMagdalene

Woke up to the mining software error again this morning. Ran the grep for xmrig and found something this time. root@Bespin:~# ps -auxf | grep -v grep | grep -i xmrig nobody 18199 292 14.7 3231768 2404120 ? Sl Feb03 4047:15 \_ ./xmrig -o 167.88.169.6:3333 -u NHbW7fJpRFQxQU8nFHP72FC6zCoDA714Xgg6.15 -k --nicehash --coin monero -a rx/0 --cpu-max-threads-hint=100 --cpu-freq=4000 No unexpected dockers running in the advanced view via GUI.

No I have my GUI exposed to the internet (my static IP) but I have beefed up my password at the start of this. I like to check things from anywhere is the reason. The other port forwards are to Tautulli and Deluge dockers, the GUIs. EDIT: And Krusader, I forgot. None that were added or removed by me, again I hadn't logged into my Unraid until authoring this post, so Feb 1st. Not sure if the logs would provide entries for anything added or removed in that window of time? There was a lot of scanning happening on my Plex server coming from Deluge downloads recently (and from me moving download locations via Deluge GUI), but I can't remember how far back that was, it feels like well before 01/28 but maybe I'm wrong. Reviewing my Deluge activity I'm seeing now that the 'Date Added' in my Deluge GUI is incorrect. Some entries date added shows 12/01/2024...So I'm not sure if I can identify what was being downloaded/seeded/moved on that date.

No additional containers showing under Advanced View. Output reveals nothing: root@Bespin:~# ps -auxf | grep -v grep | grep -i xmrig root@Bespin:~# I have never exposed SSH port forward. I have a Plex server port forwarded with the Plex default (32400) and 3 other port forwards in the 8xxx range. I have a static IP if that makes any difference.

No, there were no docker containers that I didn’t install myself. Unless they could be hidden from the GUI view? same with VMs, none that were not installed by me.

So I search in the forums for the "Possible mining software running" but nothing came up but my post here. Broadening my search to just "mining software" I ran into this forum post. Which basically directed me to a few files to review if they were compromised or had stuff I didn't put in them, which did not seem to be the case for me. I'm still unsure how or if I was indeed hacked, no other users were visibly present via the GUI or looking via console/terminal. I have restarted my server and will monitor if either of these errors come up again. I have also strengthened my Unraid server user password and reviewed my port forwards on my router and those are secure to be sure, they align with the suggestions referenced by @trurl here https://docs.unraid.net/unraid-os/manual/security/.

I saw that error too and was planning to make a separate post about it. but any direction/suggestions on how to remove a hacker/unknown would be greatly appreciated as well.

I haven't logged into my Unraid server in a month or two but I went in today and found this error above ^^. Clicking "More Information" led me to this forum post which essentially says to capture diagnostics BEFORE REBOOTING, which I did download and have attached here, and make a post under General Support. My first instinct is to review my RAM memory usage, screenshot below. And my overall storage array still have 18T of space remaining. Any help would be greatly appreciated as I have not read through any diagnostics before and am not sure if I would have noticed any warning signs leading up to this. I have not rebooted my server yet in case anyone who can help needs more information. Thanks in advance internet friends. bespin-diagnostics-20240201-1446.zip