Security scan
The Security scan tab looks through your server files for known backdoors and malware. It is useful after installing a resource, plugin or mod of doubtful origin ("leaked" files, modified versions…).
What the scan detects
- FiveM: remote code loaders hidden in resources (known families such as Cipher or Blum Panel), obfuscated URLs and calls, known backdoor domains, system commands run from a resource,
fxmanifest.lualoading a script from a URL, tampered txAdmin resource - Minecraft: traces of the Fractureiser malware in plugins and mods, plugins that grant operator rights (force-op), the OpenBukloit injector
- All games: PHP webshells, cryptocurrency miners, reverse shells, unexpected executables in resource, plugin, mod or addon folders
.jar and .zip archives are inspected. The scan runs on the machine that hosts your server: no file is sent anywhere else.
Start a scan
- Log in to the YorkHost Panel:
- Select your server
- Go to Tools → Security scan
- Click Start the scan
The progress is shown (files read, archives inspected). You can leave the page or click Cancel the scan. A new scan can be started a few minutes after the previous one with Scan again.
Read the report
The Report shows the number of files read, archives inspected and rules applied, then the findings sorted by severity:
| Severity | Meaning |
|---|---|
| Critical | Indicator specific to a known malware family: almost certain |
| High | Typical malicious construct, rare in honest code |
| Medium | Suspicious, false positives possible: to be checked |
| Info | Unexpected item, for information |
For each finding, read the What to do? section, then:
- Open: opens the file at the relevant line
- Ignore: the file will no longer be reported for this rule (Ignored findings list, with Stop ignoring to undo)
- Delete the file: after confirmation. If the finding is inside an archive, the whole archive is deleted. The file goes through the trash when it is available, so you can restore it if it was a false positive
If the scan stops before the end (too many files, too many findings or maximum duration reached), the report says so: the remaining files were not checked.
The scan recognises known threats from rules: it does not guarantee the absence of all malware, and a finding can be a false positive. Read the explanation before deleting a file, and make a backup if in doubt. If a threat is confirmed, remove the resource concerned, change any exposed passwords (database, RCON, keys) and replace it with a version downloaded from its official source.
Starting a scan and reading the report require the permission to read file contents; ignoring a finding requires the permission to edit files; deleting a file requires the permission to delete files.