How to scan a server for malware

Signs a server may be infected

• CPU, disk or network use that stays high when nobody is using the server.
• Processes, services, scheduled tasks or cron jobs that nobody on your team created.
• New administrator accounts, or new keys in authorized_keys.
• Outbound connections to addresses you do not recognise, especially at night.
• Antivirus or logging that has been switched off.
• On a file server: files renamed in bulk with a new extension, ransom notes, or executables appearing in shared folders.
• On a web server: script files in upload folders, or pages that redirect visitors elsewhere.

Free checks you can run today

On a Windows server

1. Run a full scan with the built-in Microsoft Defender:

   Start-MpScan -ScanType FullScan

2. List what starts automatically and what is listening or connecting out:

   Get-ScheduledTask | Where-Object State -ne 'Disabled'
   Get-CimInstance Win32_Service | Where-Object StartMode -eq 'Auto'
   netstat -ano

3. Check the local administrators: Get-LocalGroupMember Administrators.

On a Linux server

1. Look at what is running and what it is connected to:

   ps auxf
   ss -tunap

2. Check what runs on a schedule and who can sign in:

   crontab -l; ls -la /etc/cron.*; systemctl list-timers
   cat ~/.ssh/authorized_keys; last -n 20

3. Find files changed in the last week where code should not change, such as a web root:

   find /var/www -type f -mtime -7 \( -name '*.php' -o -name '*.js' \)

Then check what you found

• Take the SHA-256 hash of a suspicious file (sha256sum file or Get-FileHash file) and check it in the malware hash lookup.
• Upload the file itself to the free malware scan, which checks its content against signatures and rules.
• Look up any address the server is talking to with the IP address lookup to see who owns it and whether it is flagged as malicious.

If you find malware, disconnect the server from the network before you clean it, keep a copy of what you found for the investigation, and change every password that was used on it. Under NIS2, a significant incident at an essential or important entity has to be reported within 24 hours, so record the time you found it.

File servers: where the malware actually runs

A file server stores files; it rarely runs them. Infected documents and programs on a share do their damage on the computer of the person who opens them, and ransomware on one desktop can encrypt every share that person can write to. So protecting a file server means two things: scanning the files that arrive on it, and protecting every computer that opens them.

Web servers: web shells and injected code

Attackers who get into a website usually leave a web shell: a small script in the web folders that lets them run commands on the server later. Look for script files in upload folders, files with recent dates among old ones, and a web server process that starts a command shell, which a web server has no reason to do. For WordPress sites, the WordPress vulnerability check covers where the way in usually is.

Scanning continuously with an endpoint agent

Manual checks find what is there today. Our endpoint agent, Deckhand, runs on the server and keeps checking, with results for every machine in one console:

• Windows and Linux servers, with a separate build for older Windows Server 2008 R2 to 2012 R2.
• Programs checked before they start on Linux, across every mounted disk.
• New files checked as they land in the folders you choose (on a file server, the shared data folders), as well as downloads and USB drives.
• Quick, full or single-folder scans started from the console, and scheduled scans that can quarantine what they find.
• Signatures, a malware fingerprint corpus and YARA rules, with archives opened and scanned inside.
• Web shell alerts when a script file is written into a web server's folders, and a rule that can stop a web server from starting a command shell.
• Response from the console: quarantine or restore a file, stop a process, or cut the machine off the network while you investigate.

Common questions