Plex Exploit virus detected on PR4100 WD FOUR places now

running WD PR 4100 latest version
have found this twice now on 4/13/21 and 5/4/21
deleted it the first time and quarantined today.
running Anti-Virus Essentials
How do I get rid of this for good?

mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Metadata/Albums/a/373d38789d1f142120a6df5b6b60b964cab65cf.bundle/Contents/_stored/posters/tv.plex.agents.music_33fa24abd7684989291095ca17527d65389c5f5c: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED

Do you have the album Weezer’s ‘OK Human’ ? Some people reported the same about their album art.

I do, i have now gone to Discogs and used one of their images instead of the match from Plex. Will re run Anti Virus again. Only takes like 50 hours to do the full system scan.

Thanks for the response

now virus detected in 3 places, what do you have to do to get any help?

5/13/21
/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Cache/PhotoTranscoder/76/766f32167fba984259895d7061f39ed9b4253bab.jpg: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED
/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Cache/PhotoTranscoder/bb/bb7a9ac136568b33725a23c3c8620a003443b5c1.jpg: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED
/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Metadata/Albums/a/373d38789d1f142120a6df5b6b60b964cab65cf.bundle/Contents/_stored/posters/tv.plex.agents.music_33fa24abd7684989291095ca17527d65389c5f5c: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED

Now 4 Places, help is no where to be found, please someone point me in right direction.
I just deleted the Weezer OK Human file folder and rerunning Anti Virus, Will see if it picks it up again or not.
5/16/21
/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Cache/PhotoTranscoder/76/766f32167fba984259895d7061f39ed9b4253bab.jpg: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED

/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Cache/PhotoTranscoder/4d/4dedd2284bb9de3a87b911b8fdd53e816f5d9b18.jpg: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED

/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Cache/PhotoTranscoder/bb/bb7a9ac136568b33725a23c3c8620a003443b5c1.jpg: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED

/mnt/HD/HD_a2/Nas_Prog/plex_conf/Plex Media Server/Metadata/Albums/a/373d38789d1f142120a6df5b6b60b964cab65cf.bundle/Contents/_stored/posters/tv.plex.agents.music_33fa24abd7684989291095ca17527d65389c5f5c: BC.Img.Exploit.CVE-2017-16386-6404655-1 VIRUS DETECTED

Enable ssh on your settings and delete those files

I have tried the rm command and it will not delete them.

Can you share the exactly command you ran and what’s the output?

Upload that file to https://www.virustotal.com and check

To do that, he would’ve to copy the file to his machine first, and things can get worse

Don’t worry. The file cannot breathe on your computer and get it infected.
Just don’t open the file.

Or use GitHub - sevsec/vt-scan: VirusTotal Scan Script and scan directly from linux.

You could push the file(s) to a public HTTP host and submit the URL to a virus scanner. I’ve used S3 to do that recently.

https://www.virustotal.com/gui/

Personally I think these are all false positives anyway. Even if not, CVE-2017-16386-6404655-1 is an old PDF exploit and you’d need to open the files with a very old version of acrobat reader for it to even matter.

1 Like

rm 766f32167fba984259895d7061f39ed9b4253bab.jpg ’ :cant remove No such file or directory
I cant seem to get all the way to the"76" directory. If i use find it finds the file but rm does not remove it.
I can only get to plex_conf using the cd command
any ideas why?

can you give me an idea how to get the file off of the NAS drive?

It’s a false-positive, can you not just tell your AV to ignore the folder?

If a full system scan is taking ~50 hours you need to tweak what is being scanned (in my opinion).

system scan and folder scans would not produce the same results as doing the “full scan”

did a total factory reset. seems to be running better. Had a bunch of little glithes going on. Like some photos not loading and playing. While away from home music play back would start and stop. So may the whole database was FUBAR

ran full system virus scan and no virus found after factory reset and reload media files . Had to down grade to version 1.21.4.4079 as the latest update made Photos not work.

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.