VMware Cloud Community
imjajere
Contributor
Contributor

My Vms is showing numbers

Hi!

I just came to check my vms and is showing me numbers and I can only login through the esxi.

Any solution how to fix this issuevms.png

Reply
0 Kudos
4 Replies
tanjilislam
Enthusiast
Enthusiast

You must check the datastore and folders for possible attacks. 


-Tanjil Islam
If my answer has resolved your problem, please mark it as resolved, or if it has only been a good help, then give me the kudos.
Reply
0 Kudos
mike-p
Enthusiast
Enthusiast

Login via ssh and check the file names in the directories. If the files are not encrypted do a cat or less on the .vmx files. If it is not a ransomware attack you can try to reregister the vm's.

Reply
0 Kudos
sicnarf_latosa
Enthusiast
Enthusiast

Try to rescan the storage. Also check if you can still console the VM or open the VM folder see if vm files can load if not that's a storage issue. 

Reply
0 Kudos
markey165
Expert
Expert

@imjajere - as mentioned this could be a sign of ransomware. What build of ESXi are you running? ESXiArgs was doing the rounds about a year ago, and depending which variant you had, it typically encrypted the configuration files of the VMs and possibly others, rendering them inaccessible.

 

To test if the files have been encrypted or not, SSH into your ESXi host as root then run the following commands:

  • cd /vmfs/volumes
  • ls (to list the datastores. Identify the datastore(s) where your VM resides)
  • cd datastorename
  • ls (to list the VM folders in that datastore)
  • cd vmfoldername
  • ls (to list the VM files in that folder)
  • Locate the .vmx file. This is the configuration file for the VM
  • now run the command less filename.vmx to read it

If the file is intact, you should be able to read the contents, even if the VM is running. If you can't open it, or it is unreadable/garbage, then it has possibly been encrypted, or otherwise corrupted.

 

 

_____________________________________________
If this post helps you, please leave Kudo | or mark this reply as an answer
Reply
0 Kudos