Hi All,

 

I need your help please. Sometime within the last few hours all of my drives are appearing as empty and the icon for my server is showing as 'HACKED'. Is anybody able to help me at all please?

 

Regards

Gary

Attach the diagnostics zip file to your next post in this thread.

Thank you. syslog attached

syslog.txt

Tools, Diagnostics, download the zip file, attach the whole zip file to your next post.

Apologies, here is the zip.

power-tower-diagnostics-20210318-2023.zip

Are you port forwarding anything to the unraid box? Is your root password suitably complex?

Hi SpuddyUK, not port forwarding anything to my knowledge. I believe my password was just the default one

2 minutes ago, GaryBellars said:

I believe my password was just the default one

I hope not    The default is no password.

3 minutes ago, GaryBellars said:

Hi SpuddyUK, not port forwarding anything to my knowledge. I believe my password was just the default one

I'm going to say you probably are forwarding http/https to the unraid host and that you didn't have a root password. I.E anyone on the internet could access your unraid box. 

Did you put your server into your router's DMZ?

 

Does there happen to be any other diagnostics within /logs on the flash drive - relatively recent?  They might shed some light on what/why this happened.

 

As for recovery, your files are gone, but you might want to look into UFS Explorer (run on a Windows Box, to recover what you've lost), but it's probably pointless unless we can determine why this happened, otherwise it's just going to (probably) happen again.

 

Are you running a wordpress site or something via a container?

My DMZ is disabled on my router

How's your WiFi security

I thought it was good, but to be sure, I have just updated everything