I have some volumios running, and on the few past days, a strange file appear on the root.
I found a file named “fuck” and with strange *.rar files.
At 15:30 every day this file shows up and a new .rar appear with name 3501.rar
Reflash from scratch, change root, pi, volumio passwords to something long, disable SMB sharing if you don’t need it, disable USB mounting if you don’t need it, etc.
And in addition you may have another infected computer in your home network.