Virus on NAS 415+

[AllanUrup]

Hoping for help here at Christmas time.
I've got some virus on my NAS. All my files have been renamed .mars
FX a file that was previously called 1.pdf is now called 1.pdf.mars
What can I do ?

 

[ppeterr]

Hoping for help here at Christmas time.
I've got some virus on my NAS. All my files have been renamed .mars
FX a file that was previously called 1.pdf is now called 1.pdf.mars
What can I do ?

This doesnt sound good. I think your files are encrypted by ransomware.

This needs some attention by someone who has more knowledge about such.

I can only advice you, to isolate the NAS, and also for now keep other devices
disconnected from your local network.

 

[EAZ1964]

that is a bad Christmas present. The Mars encryption is a ransomware.

Most important is, to clear ALL your devices (PC,s, phones, tablets etc) with a good antivirus (Bitdefender or the like), otherwise you may be infected again, or infect others. Disconnect all from the internet/your lan that is not cleaned.

make sure all your backups are safe, do not attach them to any device or it may encrypt the backups as well.
Most probable you have been infected via mails, attachments or even an intruder on the network. Make sure you cover all that asap to prevent re-infection.

As always: do not pay, format the device and restore your backups, once your lan is completely clean!

There are some tools that claim you can decrypt this, but no experience with this.

MARS Virus Files of Ransomware — How to remove virus?

".mars" files — Is Your PC infected? Here I will assist you in removing MARS virus ransomware. Also, I will show you how to recover your computer.

howtofix.guide

MARS Ransomware

www.pcrisk.com

Succes.