Security Center:Virus detection and removal

Core capabilities

• Detection scope: Covers key scan items such as processes, startup items, scheduled tasks, and sensitive directories.

• Handling methods: Supports automatic quarantine, deep scan and removal, whitelist management, and other remediation actions.

• Scan methods: Supports immediate scan and periodic scan.

Use cases

• Regular security checks: Perform scheduled security inspections and threat cleanup.

• Emergency response: Rapid response and forensics after a security incident.

• Compliance hardening: Meet compliance audit requirements and strengthen system security.

Supported virus types and scan items

• Virus types: Ransomware, cryptomining programs, DDoS trojans, trojans, backdoors, malicious programs, high-risk programs, worms, suspicious programs, and self-mutating trojans.

• Scan items: Active processes, hidden processes, Docker processes, kernel modules, installed programs, dynamic library hijacking, services, scheduled tasks, startup items, and sensitive directories.

Pre-remediation checklist

Before choosing a response method, log on to the server to verify the suspicious file and assess the potential impact on your services.

1. Confirm file information: Check the file path, signature, and hash to verify whether it is malicious. This prevents accidental removal of critical files.

2. Check processes and ownership: Determine whether the file is used by critical services such as nginx or mysql.

3. Assess business impact: Confirm whether the file is part of a business application and whether removing it will affect running services.

Choose a handling method

In the alert list, find the target alert and click Handle to select an action based on your assessment. Click the arrow to the left of an alert to view details such as the virus file path.

The expanded details also include Malicious File MD5 and Process ID.

Enable alert notifications

Configure alert notifications on the System Settings > Notification Settings page to notify responsible personnel by email, SMS, or DingTalk when high-risk threats are detected. For more information, see Notification Settings.

In the Security Alerts notification configuration area, complete the following settings:

• Notification Time: Select 24 Hours or 8:00 - 20:00.

• Alert Severity: Select Urgent, Suspicious, or Reminder as needed.

• Notification Method: Select SMS, Email, or Internal Message as needed.

Performance optimization and incident response

• Performance optimization:

  • For low-specification servers (for example, 1-core CPU and 1 GB of memory), run a Quick Scan during off-peak hours and disable Memory Check to reduce resource consumption.

  • For large-scale scans, run in batches or exclude large log and backup directories in Scan Settings to reduce scan time.

• Emergency response process:

  1. Immediate isolation: After detecting a high-risk threat, use security group rules to block abnormal ports or restrict access to only your office IP to prevent attackers from continuing to control the server.

  2. Forensics backup: Create a snapshot for the server and back up key logs such as /var/log/secure and /var/log/cron.

  3. Deep scan and removal: Use the Deep Scan and Removal feature in Security Center to remove malicious processes, webshells, and persistence mechanisms, including Crontab scheduled tasks, SSH public keys ~/.ssh/authorized_keys, and dynamic library hijacking.

  4. Vulnerability remediation: Scan and fix system and application vulnerabilities. Change all weak passwords to strong passwords.

  5. Security hardening: Enable Malicious Host Behavior Prevention for proactive interception (see Malicious Host Behavior Prevention for details). Restrict remote logon IPs and open only necessary ports.

  6. Continuous monitoring: Continuously monitor the server status to confirm that the threat does not recur.

• Root cause remediation:

  If the server is repeatedly infected or the virus has penetrated deep into the system, take the following measures:

  • Back up your business data and then reset the system disk. In the ECS console, find the corresponding instance and select Initialize Disk from All Operations (the instance must be stopped).

  • Before redeploying your business, complete security hardening first (change passwords, close unnecessary ports, and install the latest patches).

  • Create regular snapshot backups for quick recovery if the system is compromised.

Security hardening recommendations

To protect your servers from future attacks, implement the following hardening measures to increase the difficulty for attackers.

• Enable Malicious Host Behavior Prevention

  Enable this feature on the Protection Configuration > Host Protection > Malicious Host Behavior Prevention page. It proactively blocks malicious behaviors of common viruses including trojans, ransomware, cryptomining programs, and DDoS trojans. For more information, see Malicious Host Behavior Prevention.

• Server security hardening

  • Upgrade Security Center Edition: The Enterprise and Ultimate editions support the virus automatic isolation (i.e., automatic virus detection and removal) feature, providing you with precise defense capabilities and supporting more security detection items.

  • Tighten Access Control: Open only necessary business ports (such as 80 and 443), and configure strict IP whitelist access policies for management ports (such as 22 and 3389) and database ports (such as 3306).

    Note

    For Alibaba Cloud ECS servers, see Manage security groups for operations.

  • Set Complex Server Passwords: Set complex passwords containing uppercase letters, lowercase letters, numbers, and special symbols for servers and applications.

  • Upgrade Software: Promptly update your application software to the latest official version to avoid using outdated versions that are no longer maintained or have known security vulnerabilities.

  • Regular Backups: Create a regular snapshot policy for important data and server system disks.

    Note

    For Alibaba Cloud ECS servers, see Create policy for operations.

  • Fix Vulnerabilities Promptly: Regularly use the Security Center Vulnerability Management feature to promptly patch system and application vulnerabilities.

  • Reset Server System (Use with Caution).

    If the virus intrusion is deep and involves underlying system components, it is strongly recommended that you reset the server system after backing up important data. Follow these steps:

    1. Create a snapshot to back up important data on the server. For more information, see Manually create a single snapshot.

    2. Initialize the server operating system. For more information, see Re-initialize system disk (reset OS).

    3. Create a cloud disk from the snapshot. For more information, see Create a data disk from a snapshot.

    4. Attach the cloud disk to the server after reinstalling the system. For more information, see Attach a data disk.

• Emergency response for SSH weak password intrusion

  If your server is intruded due to an SSH weak password, we recommend that you immediately perform the following actions:

  1. Change the password: Immediately change the root password to a complex password that includes uppercase and lowercase letters, numbers, and special characters. Change it regularly.

  2. Check for backdoors: Check for abnormal processes, unknown accounts, suspicious scheduled tasks, and SSH public keys. Remove any traces of intrusion.

  3. Block the attacker: Block the attacker's source IP in the security group. Restrict SSH and remote desktop access to trusted IPs only.

  4. Complete cleanup: If you cannot confirm the scope of the intrusion, we recommend backing up your business data, initializing the system disk, and redeploying your business. In the ECS console, find the corresponding instance, click the instance name, and select Initialize Disk from All Operations in the upper-right corner (the instance must be stopped).

Whitelist and ignore questions

• How do I remove an item from a whitelist?

  The Virus detection and removal module does not support removing whitelist items. Navigate to Detection and Response > Alert, find the handled alert, and remove it from the whitelist. For more information, see Remove an alert from the whitelist.

  Note

  If you purchased the Agentic SOC service, choose Agentic SOC > Alert.

• What is the difference between adding to a whitelist and ignoring an alert?

  Comparison item	Add to Whitelist	Ignore
  Use case	Confirmed false positive, and you want to permanently stop receiving these alerts.	Temporary or sporadic false positive, or a known and acceptable risk.
  Impact scope	Alerts with matching characteristics (same asset + same file path + same MD5) are no longer generated. Only the last occurrence time is updated.	Applies only to the current alert. If the same threat reappears, a new alert is generated.
  Reversible	You can cancel the whitelist entry in the handled list under Detection and Response > Alert.	No reversal needed. Ignoring an alert does not affect future detection; the system continues to monitor for the same threat.

Virus detection and alert handling questions

• What is the difference between Virus detection and removal and Security Alert?

  • Virus detection and removal is a feature module focused on detecting and removing malicious files, providing deep scanning and specialized remediation capabilities.

  • Security Alert is a unified alert center that consolidates all security events, including viruses, unusual logons, network attacks, and vulnerabilities.

  Important

  • Alerts from this feature sync bidirectionally with the Security Alert module. Handle alerts in either module.

  • The virus detection and removal feature is used only to detect and clean malicious files. After virus removal, if no risks are confirmed, it generally does not trigger a ban. If you still experience access issues after removal, we recommend checking security group rules, internal server firewalls, and other potential causes.

• Why do viruses reappear after remediation?

  Common causes:

  • The root cause is not resolved: Weak passwords or unpatched vulnerabilities allow attackers to regain access.

  • Incomplete cleanup: Hidden backdoors or persistence mechanisms were not fully removed.

  • Contaminated data source: Data restored from an infected backup or image.

  Solution:

  • Follow the security hardening recommendations to strengthen your security posture.

  • After remediation, restart the server and its applications to terminate malicious processes lingering in memory.

    Warning

    • Restarting a server causes a brief service interruption. Websites, applications, and dependent services become inaccessible. Perform this operation during off-peak hours.

    • Some applications may require a manual restart if they are not configured for auto-start or depend on specific environment variables. Evaluate the restart plan in advance, especially for services such as message queues.

• How do I handle multiple alerts at a time?

  • Virus alerts generated by the Protection Configuration > Host Protection > Virus Detection and Removal module support batch handling.

    1. On the Virus detection and removal page, select the alerts that you want to handle by clicking the checkbox on the left.

    2. In the lower-left corner, click the Batch Handle button and select an appropriate response method.

  • The Detection and Response > Alert module supports batch whitelisting and batch ignoring.

    1. On the Security Alert page, select the alerts that you want to handle by clicking the checkbox on the left.

    2. In the lower-left corner, click Ignore Once or Add to Whitelist.

• What do I do if an alert indicates that a file does not exist?

  The virus may have been removed by another method or deleted its own traces. Click "Ignore" or "Manually Handled" to dismiss the alert.

• Why do virus alerts continue to be sent after the virus is removed?

  Security Center retains historical threat records (retention period is about 1 year). Even if the virus file has been cleared, the historical alert records remain. If you do not perform actions such as "Ignore" or "Manually Handled" on the alerts, the system may continue to send notifications.

  Solution:

  • After confirming the virus is cleared, perform Ignore or Manually Handled on the relevant alerts in the alert list.

  • If you still receive abnormal logon alerts for an old IP after changing the public IP, confirm that the alert time is before the IP change. You can safely ignore it and synchronize the latest asset information.

• Why do old alerts still appear after I reinstall the operating system?

  After you reinstall the operating system, Security Center may retain previous scan results and alert records. To obtain the latest security status and clear old alerts, manually trigger a scan by clicking Immediate Scan or Rescan. After the scan is complete, the system updates detection results based on the new system environment. Old inactive alerts are cleaned up or their status is updated.

• How do I troubleshoot a persistent backdoor (virus keeps reappearing or cannot be removed)?

  If a virus keeps reappearing or cannot be completely removed, a persistent backdoor may exist. We recommend checking the following items one by one:

  • Scheduled tasks: Check crontab (Linux) or Task Scheduler (Windows) to confirm whether any suspicious scheduled tasks exist.

  • Startup items: Check startup items (Linux: /etc/init.d/, systemd services; Windows: registry startup items) to confirm whether any suspicious programs exist.

  • SSH public keys: Check the ~/.ssh/authorized_keys file to confirm whether any unknown SSH public keys exist.

  • Hidden files: Some virus files may be located in hidden system directories (for example, the Windows Recycle Bin $Recycle.Bin directory). To view them, enable the display of hidden files and system files as an administrator. The Security Center agent scans at a low level to obtain file paths and is not restricted by file system visibility.

• Does virus detection and removal support the Alibaba Cloud app on mobile devices?

  No. The virus detection and removal and security alert handling features are available only through the Security Center web console. The Alibaba Cloud mobile app does not support virus detection, removal, or alert handling.

Scan and task execution questions

• What do I do if a scan task fails or times out?

  • Task timeout: Usually caused by a custom scan directory that is too large. Solutions:

    • Split large scans into multiple Custom Directory Scan tasks targeting high-risk directories such as /tmp, /var/tmp, and /root.

    • Exclude large log or data directories in the scan configuration.

    • Run scans during off-peak hours.

  • Task failure:

    1. Check agent status: Verify that the Security Center agent (AliYunDun) is running and online.

    2. Check network connectivity: Test whether the server can reach the Security Center endpoint.

    3. Check system resources: Ensure /tmp has at least 1 GB free disk space and that CPU and memory are not exhausted.

    4. View agent logs: The log path on a Linux server is /usr/local/aegis/aegis_client/aegis_10_*/log/aegis.log.

• What do I do if virus remediation fails?

  Refresh the page and retry. If it still fails, click "Manually Handled" and delete the file manually. If deletion fails with "Operation not permitted", the file may have the i (immutable) attribute. Run chattr -i <file> to remove it, then delete the file.

System compatibility and tool configuration questions

• Where can I check the virus signature database version?

  View the virus signature database update time on the Overview page. The cloud-based virus signature database is updated automatically in real time; no manual action is required.

  The right side of the Overview page also displays the Cloud Scan Time (Latest Time).

• Why does the virus detection and removal page occasionally show an error page (no rescan button)?

  This is usually caused by insufficient RAM account permissions. If you use this feature for the first time, the system may prompt you to authorize a service-linked role for Security Center. Click Authorize Now (the blue authorization button) on the page to complete the authorization and use the feature normally.

  If you have already authorized but still see the error page, confirm that the current RAM account has full access permissions for Security Center. If necessary, contact the primary account administrator to grant the required permissions.

• Can I install third-party antivirus software (360/Huorong)?

  Yes, but compatibility issues may occur. We recommend adding the Security Center agent processes and directories (see Agent processes) to the third-party software's whitelist to prevent false positives.

  For Windows servers that continuously receive virus alerts, we recommend using third-party antivirus software for a full-disk scan as a supplementary troubleshooting method. We recommend 360 Antivirus Speed Edition or Huorong Antivirus for a full scan. We also recommend checking the internal server firewall configuration (such as Windows Firewall, iptables, or firewalld) to rule out access issues caused by firewall rules.

• What do I do if the page does not respond after I click Authorize Now?

  If the page keeps spinning or does not respond after you click Authorize Now, this may be caused by network fluctuation or browser cache. We recommend refreshing the page and re-entering the Virus Detection and Removal console to check the authorization status. If it still fails, try clearing the browser cache, using incognito (private browsing) mode, or switching to a different browser.

• What do I do if the Virus Detection and Removal page shows 0 assets or indicates that no paid edition is bound?

  If the Virus Detection and Removal page shows 0 assets or indicates that no paid edition is bound, troubleshoot as follows:

  • Protection Configuration: Ensure that the target server is bound to a paid protection version or level.

    • Subscription: Anti-virus edition or higher. For detailed steps, seeSubscription billing model.

    • Pay-As-You-Go: Virus Protection level or higher. For detailed steps, see Pay-as-you-go billing model.

  • Agent status check: Ensure that the Security Center agent on the target server is online and the version is normal. If the agent is offline, reinstall or restart the agent.

• What do I do if only "Add to Whitelist" and "Ignore" options are available when handling an alert?

  Some alerts may only show "Add to Whitelist" and "Ignore" options, missing "Kill Process" and "Virus Detection and Removal" options. This is usually because the malicious process is still running and the system cannot handle it directly.

  Solution: First select "Kill Process" (if available), then refresh the page and retry to get the complete set of handling options. If this does not resolve the issue, refer to the "virus remediation failed" troubleshooting steps above to handle it manually, then click "Manually Handled".