How to quickly find and filter suspected trojan/backdoor files on a cloud server

This tutorial is only applicable for batch scanning backdoors on servers and files with injected malware. Note that based on scan results, manual analysis and judgment are required, then clean up the injected malware, be cautious when deleting files!!!

Linux Cloud Server:

1. ssh remote login to the server, download with wget http://download.myhostadmin.net/FileScan/hm-linux-amd64.tgz  , and extract with tar xzf hm-linux-amd64.tgz.

2. Execute command: ./hm update to update the virus database.

3. Execute command: ./hm scan /home/wwwroot/ #(/home/wwwroot/ is the main site directory).

4. After the scan is complete, the results will be saved as result.csv file. Download this file locally and use EditPlus to open and view the results.

5. The prerequisite is that the server network is working properly. If the server is disconnected from the network, scanning cannot be performed.

Windows Cloud Server:

1. First remotely connect to the server and download http://download.myhostadmin.net/FileScan/HwsKill.rar and extract it.

2. Open 护卫神, select custom scan (the site directory is usually the d:\wwwroot\ directory).

3. Analyze the scan results and clean up backdoor files.

4. Generally, this tool can also be used to clean backdoors on our virtual hosts. Select remote scan to configure ftp.

Note: The above methods are for quickly finding and screening suspected injected malware and backdoor files. Files must be manually analyzed and reviewed again. Clean up injected malware and perform other handling according to the actual situation. Be sure to be cautious when deleting files!!!