Removing Bots & Malware

This guide shows how to find, stop and remove malicious processes such as bots or crypto miners on a compromised Linux or Windows server. It also lists the steps required after cleanup to close the entry point.

Act immediately. After cleanup, change all passwords right away and fix the root cause of the compromise — patch outdated software, replace weak passwords, and review which accounts were affected. The server is considered untrusted until the entry point has been identified and closed.

Linux Server

Identify suspicious processes with ss and /proc, kill the process, and remove the malicious directory.

Go to Linux guide →

Windows Server

Find malicious processes via Task Manager and PowerShell, stop them, and run a full Defender offline scan.

Go to Windows guide →

Linux Server

Step 1: Check for suspicious connections

Use ss (or the older netstat) to find unusual open connections — watch for non-standard ports (e.g. 6667 / IRC) or processes with a SYN_SENT status masquerading as legitimate services like sshd:

Terminal

ss -tunap | grep 6667 # alternative with net-tools: netstat -plant | grep 6667

Step 2: Identify the process path

Once you have the Process ID (PID) from the output, check the actual location of the executable in /proc:

Terminal

ls -l /proc/21394/exe

If the path points somewhere unexpected — like /usr/local/games/.bot/httpd instead of a real system binary — the process is malicious.

Step 3: Kill the process

Forcefully terminate the process using its PID:

Terminal

kill -9 21394

Step 4: Delete the malicious directory

Navigate to the parent directory and recursively delete the malicious folder — this ensures no recovery scripts remain:

Terminal

cd /usr/local/games rm -rf .bot/

Helpful resources for Linux

CISA — Malware Response

Official guidance on malware, phishing, and ransomware incident response.

cisa.gov →

Linux Incident Response Guide

Tools and techniques for investigating a compromised Linux server — log analysis, rootkit detection, and forensics.

linux-audit.com →

BSI — Malware Information

German Federal Office for Information Security — malware types and protection recommendations.

bsi.bund.de →

chkrootkit

Free tool to locally check for signs of a rootkit on Linux servers.

chkrootkit.org →

Windows Server

Step 1: Find suspicious processes

Open Task Manager (Ctrl+Shift+Esc) → Details tab. Look for processes with unusually high CPU or memory usage, random-looking names, or processes running under an unexpected system user.

Step 2: Identify the process path

To get the full file path of a suspicious process, run the following in PowerShell — replace SuspectProcessName with the name from Task Manager:

PowerShell

Get-Process -Name "SuspectProcessName" | Select-Object Path

If the path points to Temp, AppData, or C:\ProgramData, the process is very likely malicious.

Step 3: Terminate the process

Stop the process via PowerShell using either the PID or the process name:

PowerShell

Stop-Process -Id 9876 -Force Stop-Process -Name "SuspectProcessName" -Force

Step 4: Delete the file and run a scan

Delete the executable file identified in Step 2. Then run a full Offline Scan with Microsoft Defender Antivirus to find and isolate all related components — the offline scan runs before Windows boots, so it can catch malware that hides during normal operation.

Helpful resources for Windows

Microsoft Defender — Malware Encyclopedia

Look up specific malware families, their behavior, and recommended removal steps.

learn.microsoft.com →

Windows Security Guide

Official Microsoft guide to using Windows Security for virus and threat protection.

support.microsoft.com →

CISA — Malware Response

Official US cybersecurity guidance on malware and ransomware incident response.

cisa.gov →

Sysinternals Autoruns

Microsoft tool to see all programs configured to run at startup — useful for finding persistent malware.

learn.microsoft.com →

After Cleanup — Required Actions

Do not skip these steps:

Reset all passwords — immediately change the passwords for all accounts, especially root / Administrator and any user under which the malicious process was running.

Disable compromised accounts — disable all affected or unknown user accounts. On Linux: lock the account with usermod -L username and set its shell to /usr/sbin/nologin (usermod -s /usr/sbin/nologin username). On Windows: disable the account in User Management.

Install all updates — ensure the OS and all installed applications are fully patched to close known vulnerabilities.

Audit your server — review open ports, running services, cron jobs (Linux), and scheduled tasks (Windows) for further traces of the intrusion.