How to determine if the running process [oom_reaper] is normal system process?
Last modified date:
2022-06-24
Applicable Products:
- Security
A bitcoin miner has been reported to target QNAP NAS. Once a NAS is infected, CPU usage becomes unusually high where a process named "[oom_reaper]" could occupy around 50% of the total CPU usage. This process mimics a kernel process but its PID is usually greater than 1000.
You can check the PID by the procedures below.
-
Run ps | grep oom_reaper and check the output.
-
In the following output example, 580 is the PID of [oom_reaper]
-
if the PID < 1000, the process is a normal system process.
-
if the PID > 1000, follow the instructions below.
- Update QTS or QuTS hero to the latest version.
- Install and update Malware Remover to the latest version.
- Use stronger passwords for your administrator and other user accounts.
- Update all installed applications to their latest versions.
- Do not expose your NAS to the internet, or avoid using default system port numbers 443 and 8080.
-
Related link:
-
Security Advisroy: Bitcoin Miner [oom_reaper]
