Checking for malware - Hetzner Docs

If you suspect your server has been compromised, you can scan the system from within the rescue system. This has the advantage that potential malware is not active during the scan.

Enable the rescue system

As explained in this getting started:
- Select the server
- Navigate to "Rescue" and click on "Enable rescue & power cycle"
- After the reboot, connect to the server as root user.

Create a chroot environment

Run lsblk and identify the name of the root partition (e.g. sda1).

Mount the root partition into /mnt and create the chroot environment:

Replace sda1 with the name of your root partition.
```
mount /dev/sda1 /mnt
chroot-prepare /mnt
chroot /mnt   
```
You can now navigate through the file structure of your server's primary disc.

Scan the system
- Install and run a malware scanner. For example, ClamAV:
```
apt update
apt install clamav -y
freshclam
clamscan -r -i / --exclude-dir="^/sys" --exclude-dir="^/proc"
```
  The -r flag scans recursively, -i only prints infected files.
- Use rkhunter to check for rootkits:
```
apt install rkhunter -y
rkhunter --update
rkhunter --check --skip-keypress
```
Review the scan results carefully. If malware is found, we strongly recommend reinstalling the server from scratch rather than only removing the detected files, as compromised systems may contain additional backdoors.

Restart the server

Run exit to leave the chroot environment and restart your server to leave the rescue system:
```
exit
reboot
```

After reboot, you should be able to log in the normal system again.