Blog | G5 Cyber Security

Remove Backdoor File

G5 Cyber Security

TL;DR

A backdoor file has been found on your system. This guide will help you identify and remove it, along with steps to secure your system against future attacks.

1. Identify the Backdoor File

The first step is finding the malicious file. You’ll need some clues about its location or name. Common places backdoors hide include:

Look for files with unusual names or extensions (e.g., .php, .exe, .sh) that don’t belong to legitimate applications.

Using command line tools:

# Linux/macOS - Find recently modified files
find / -type f -mtime -1

# Windows (PowerShell) - Find recently modified files
Get-ChildItem -Path C: -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}

Scanning with antivirus software: Run a full system scan with your installed antivirus program. Make sure it’s up to date.

2. Confirm the File is Malicious

Before deleting anything, be *sure* it’s a backdoor. False positives can happen.

If VirusTotal flags it as malicious or the hashes don’t match, proceed with removal.

3. Remove the Backdoor File

Once you’ve confirmed the file is a backdoor, remove it immediately.

# Linux/macOS
rm /path/to/backdoor_file

# Windows (Command Prompt)
del C:pathtobackdoor_file
  • If the file is in use: You may need to restart your computer in Safe Mode to delete it.

    • 4. Investigate for Persistence

    Backdoors often try to run automatically when you start your computer (persistence). Check these locations:

    Remove any entries related to the backdoor file.

    5. Check for Other Malicious Files

    A single backdoor may be part of a larger infection. Scan your system again with updated antivirus software and consider using a second opinion scanner (e.g., Malwarebytes).

    6. Secure Your System

    Prevent future infections by following these steps:

    Exit mobile version