QNAP NAS user? You'd better check your hosts file for mystery anti-antivirus entries

NAS-ty: Strange activity sinkholes antivirus update checks

Network attached storage maker QNAP's customers have reported being hit by a mystery malware that disables software updates by hijacking entries in host machines' hosts file.

The full effects are, as yet, unknown – but users have reported that the most visible symptom is that some 700 entries are added to the /etc/hosts file that redirect a bunch of requests to IP address 0.0.0.0.

This, said forlorn QNAP forum user ianch99, stopped his antivirus from updating by sinkholing all of the software's requests to the vendor's website. Others reported that the Taiwanese NAS appliance maker's own MalwareRemover was borked, though it is not known whether these two things are linked.

"If you remove these entries, the update runs fine but they return on after rebooting," posted ianch99. So far the only cure appeared to be a script provided by QNAP itself, which one helpful Reddit user posted the link to after apparently being given it by one of the storage firm's techie in live chat.

Other users publicly wondered about the QNAP's seeming reluctance to say anything about the issue, with a Reg reader telling us: "The wider QNAP-using population could perhaps do with a heads-up from your esteemed organ."

QNAP failed to respond when The Register asked the company to comment on these goings-on, and has made no public statement at the time of writing.

A couple of years ago firmware from the Taiwanese headquartered biz was discovered to have a catastrophic bug that corrupted data on RAID drives during a rebuild "through faulty calculations". It was eventually patched.

For those who haven't poked around the quieter corners of their operating systems, /etc/hosts forces domain name lookups made from the host machine to go to specified IP addresses. The normal non-malicious use is to enforce blocking of unwanted sites.

While useful for persistent windups on colleagues by doing silly things like redirecting Google to Bing, that very same simplicity makes it an attractive target for malware authors bent on stopping updates to counter-malware programs, as Malwarebytes pointed out a few years ago. ®