badirontree

Thank you because they got in again 7/11/23 I decided to just PURGE the server and router setting and setup from the start again.... all new passwords But this time they only encrypted 3 folders/pc that were visible in local network... I will check also my TV + cameras that are IP/ IOT for infections...

same here

nope, we fixed the problem 3 months ago... we had 3000 attempts to login each day... Most bot tried to run EXE files .... So far nothing is accessing the server since is not online anymore... The bigger problem was we did not notice any problems, since the server had a lot of TB and the only encrypted was the old 2022 files (original hack) ... If we had to restore a backup then it would be a problem... Anyway I think its time to make a new setup from the start. What is the faster way to purge all setting and files from the server ? Thanks

Its a very old setup of urbackup that is keep getting updates... 02/2023 we had our files encrypted only in the unraid server somehow... all the pc that take the backup did not had any problems... After i closed the remote access all the login attempts stopped ################################################### # ###### ############## YOUR FILES HAVE BEEN ENCRYPTED ############### ################################################### # ###### -- YOUR FILES ARE SAFE! ENCRYPTED ONLY :: ChaCha + AES WE STRONGLY RECOMMEND that you DO NOT use any "Decryption Tools". These tools can corrupt your data, making recovery IMPOSSIBLE. We also recommend not contacting data recovery companies. They will just contact us, buy the key and sell it to you for a higher price. If you want to decrypt your files, you need to get the RSA private key. All your files have been encrypted with 0XXX Virus. Your unique id: 2DE6A896046849E09DB547C7A2A25307 You can buy decryption for 2500$USD in Bitcoins. To do this: 1) Send your unique id 2DE6A896046849E09DB547C7A2A25307 and max 3 files for test decryption to [email protected] 2) After decryption, we will send you the decrypted files and a unique bitcoin wallet for payment. 3) After payment ransom for Bitcoin, we will send you a decryption program and instructions. If we can decrypt your files, we have no reason to deceive you after payment. Also after payment we will give you some tips to protect yourself from this in the future. I may start over will on the setup from the start... The new backups work fine... the old were encrypted and we could not delete them from the UI I delete them manually to save space

btw i took the db manual and open it fine... Line 39363 was: /media/videoserver-PC/221121-1107/C/Program Files/WindowsApps/king.com.CandyCrushSodaSaga_1.230.400.0_x64__kgqvnymyfvs32/res_output/shared/levels/main_progression/level9313.0.json

I had to delete some backups manually And now the UI show 2022 backups that we cannot delete.... I try to use the urbackupsrv remove-unknown But I get : sh-5.1# urbackupsrv remove-unknown 2023-10-30 14:18:35: Going to remove all unknown files and directories in the urbackup storage directory. Waiting 20 seconds... 2023-10-30 14:18:55: Shutting down all database instances... 2023-10-30 14:18:55: Opening urbackup server database... 2023-10-30 14:18:55: WARNING: SQLite: cannot open file at line 39363 of [3bfa9cc97d] errorcode: 14 2023-10-30 14:18:55: WARNING: SQLite: os_unix.c:39363: (13) open(/var/urbackup/backup_server_files.db) - errorcode: 14 2023-10-30 14:18:55: Could not open db [urbackup/backup_server_files.db] 2023-10-30 14:18:55: ERROR: Database "urbackup/backup_server_files.db" couldn't be opened 2023-10-30 14:18:55: ERROR: Couldn't open backup server database. Exiting. Expecting database at "/var/urbackup/backup_server_files.db" sh-5.1# and when i try to repair I get sh-5.1# urbackupsrv repair-database 2023-10-30 14:26:42: WARNING: SQLite: cannot open file at line 39363 of [3bfa9cc97d] errorcode: 14 2023-10-30 14:26:42: WARNING: SQLite: os_unix.c:39363: (13) open(/var/urbackup/backup_server_files.db) - errorcode: 14 2023-10-30 14:26:42: Could not open db [urbackup/backup_server_files.db] 2023-10-30 14:26:42: ERROR: Database "urbackup/backup_server_files.db" couldn't be opened 2023-10-30 14:26:42: ERROR: Couldn't open backup server database. Exiting. Expecting database at "/var/urbackup/backup_server_files.db" sh-5.1#

Created by... ___. .__ .__ \_ |__ |__| ____ | |__ ____ ___ ___ | __ \| |/ \| | \_/ __ \\ \/ / | \_\ \ | | \ Y \ ___/ > < |___ /__|___| /___| /\___ >__/\_ \ \/ \/ \/ \/ \/ https://hub.docker.com/u/binhex/ 2021-02-02 12:50:37.523192 [info] System information Linux Tower 4.19.107-Unraid #1 SMP Thu Mar 5 13:55:57 PST 2020 x86_64 GNU/Linux 2021-02-02 12:50:37.569489 [info] OS_ARCH defined as 'x86-64' 2021-02-02 12:50:37.615763 [info] PUID defined as '99' 2021-02-02 12:50:38.164533 [info] PGID defined as '100' 2021-02-02 12:50:39.038953 [info] UMASK defined as '000' 2021-02-02 12:50:39.082596 [info] Permissions already set for volume mappings 2021-02-02 12:50:39.134207 [info] Deleting files in /tmp (non recursive)... [info] Creating soft link from /config/urbackup to /var/urbackup... 2021-02-02 12:50:39.208345 [info] Starting Supervisor... 2021-02-02 12:50:39,548 INFO Included extra file "/etc/supervisor/conf.d/urbackup.conf" during parsing 2021-02-02 12:50:39,548 INFO Set uid to user 0 succeeded 2021-02-02 12:50:39,554 INFO supervisord started with pid 6 2021-02-02 12:50:40,557 INFO spawned: 'shutdown-script' with pid 65 2021-02-02 12:50:40,560 INFO spawned: 'urbackup' with pid 66 2021-02-02 12:50:40,560 INFO reaped unknown pid 7 (exit status 0) 2021-02-02 12:50:40,603 DEBG 'urbackup' stderr output: /home/nobody/start.sh: line 20: 72 Illegal instruction /usr/bin/urbackupsrv run --config /config/urbackup/config/urbackupsrv --no-consoletime 2021-02-02 12:50:40,604 INFO success: shutdown-script entered RUNNING state, process has stayed up for > than 0 seconds (startsecs) 2021-02-02 12:50:40,604 DEBG fd 11 closed, stopped monitoring <POutputDispatcher at 23137572003792 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stdout)> 2021-02-02 12:50:40,604 DEBG fd 15 closed, stopped monitoring <POutputDispatcher at 23137572077728 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stderr)> 2021-02-02 12:50:40,604 INFO exited: urbackup (exit status 132; not expected) 2021-02-02 12:50:40,605 DEBG received SIGCHLD indicating a child quit 2021-02-02 12:50:41,608 INFO spawned: 'urbackup' with pid 73 2021-02-02 12:50:41,629 DEBG 'urbackup' stderr output: /home/nobody/start.sh: line 20: 78 Illegal instruction /usr/bin/urbackupsrv run --config /config/urbackup/config/urbackupsrv --no-consoletime 2021-02-02 12:50:41,629 DEBG fd 11 closed, stopped monitoring <POutputDispatcher at 23137572419760 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stdout)> 2021-02-02 12:50:41,630 DEBG fd 15 closed, stopped monitoring <POutputDispatcher at 23137572077824 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stderr)> 2021-02-02 12:50:41,630 INFO exited: urbackup (exit status 132; not expected) 2021-02-02 12:50:41,630 DEBG received SIGCHLD indicating a child quit 2021-02-02 12:50:43,633 INFO spawned: 'urbackup' with pid 79 2021-02-02 12:50:43,655 DEBG 'urbackup' stderr output: /home/nobody/start.sh: line 20: 84 Illegal instruction /usr/bin/urbackupsrv run --config /config/urbackup/config/urbackupsrv --no-consoletime 2021-02-02 12:50:43,656 DEBG fd 11 closed, stopped monitoring <POutputDispatcher at 23137572003792 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stdout)> 2021-02-02 12:50:43,656 DEBG fd 15 closed, stopped monitoring <POutputDispatcher at 23137572077920 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stderr)> 2021-02-02 12:50:43,656 INFO exited: urbackup (exit status 132; not expected) 2021-02-02 12:50:43,656 DEBG received SIGCHLD indicating a child quit 2021-02-02 12:50:46,661 INFO spawned: 'urbackup' with pid 85 2021-02-02 12:50:46,683 DEBG 'urbackup' stderr output: /home/nobody/start.sh: line 20: 90 Illegal instruction /usr/bin/urbackupsrv run --config /config/urbackup/config/urbackupsrv --no-consoletime 2021-02-02 12:50:46,683 DEBG fd 11 closed, stopped monitoring <POutputDispatcher at 23137572419760 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stdout)> 2021-02-02 12:50:46,683 DEBG fd 15 closed, stopped monitoring <POutputDispatcher at 23137572077680 for <Subprocess at 23137572583456 with name urbackup in state STARTING> (stderr)> 2021-02-02 12:50:46,684 INFO exited: urbackup (exit status 132; not expected) 2021-02-02 12:50:46,684 DEBG received SIGCHLD indicating a child quit 2021-02-02 12:50:46,684 INFO gave up: urbackup entered FATAL state, too many start retries too quickly After today update I can not access the urbackup adress