[{"data":1,"prerenderedAt":485},["ShallowReactive",2],{"panduan-article-cara-scan-dan-mengatasi-vps-yang-terdeteksi-malware":3},{"article":4,"category":472},{"id":5,"title":6,"body":7,"created_at":460,"description":461,"extension":462,"featured":463,"meta":464,"navigation":465,"ogImage":466,"path":467,"robots":466,"schemaOrg":466,"seo":468,"sitemap":469,"stem":470,"updated_at":460,"__hash__":471},"knowledgeBase\u002Fpanduan\u002Fvps\u002Fcara-scan-dan-mengatasi-vps-yang-terdeteksi-malware.md","Cara Scan dan Mengatasi VPS yang Terdeteksi Malware",{"type":8,"value":9,"toc":453},"minimark",[10,14,19,22,131,135,138,235,239,242,312,316,319,405,409,449],[11,12,13],"p",{},"Panduan ini menjelaskan prosedur untuk mendeteksi, mendiagnosis, dan membersihkan berkas jahat (malware) pada Virtual Private Server (VPS) melalui terminal Linux menggunakan alat pemindai seperti ClamAV, Rkhunter, dan Maldet. Pemindaian dan pembersihan malware secara rutin sangat bermanfaat untuk menjaga integritas data, mencegah kebocoran informasi sensitif, serta memastikan kinerja server tetap stabil dan tidak masuk ke dalam daftar hitam (blacklist).",[15,16,18],"h2",{"id":17},"i-persiapan-lingkungan-kerja-dan-instalasi-tools-pemindai","I. Persiapan Lingkungan Kerja dan Instalasi Tools Pemindai",[11,20,21],{},"Langkah awal yang harus dilakukan adalah mengakses server melalui protokol SSH dan memasang perangkat lunak pemindai keamanan yang dibutuhkan.",[23,24,25,60,101],"ol",{},[26,27,28,32,35,36,53,55,59],"li",{},[29,30,31],"strong",{},"Akses Server via Terminal SSH",[33,34],"br",{},"Buka terminal atau aplikasi SSH client (seperti PuTTY atau Termius) dan hubungkan ke VPS Anda dengan akun superuser:",[37,38,43],"pre",{"className":39,"code":40,"language":41,"meta":42,"style":42},"language-plaintext shiki shiki-themes github-light github-dark","ssh root@alamat_ip_vps\n","plaintext","",[44,45,46],"code",{"__ignoreMap":42},[47,48,51],"span",{"class":49,"line":50},"line",1,[47,52,40],{},[33,54],{},[56,57,58],"em",{},"Hasil yang diharapkan:"," Akses terminal ke server berhasil dibuka dan menampilkan prompt command line.",[26,61,62,65,67,68,71,72,74,75,84,86,87,96,98,100],{},[29,63,64],{},"Instalasi ClamAV dan Modul Pendukung",[33,66],{},"Jalankan pembaruan repositori dan instalasi antivirus ",[29,69,70],{},"ClamAV"," sesuai distribusi Linux Anda:",[33,73],{},"Untuk pengguna Ubuntu\u002FDebian:",[37,76,78],{"className":39,"code":77,"language":41,"meta":42,"style":42},"apt update && apt install clamav clamav-daemon rkhunter -y\n",[44,79,80],{"__ignoreMap":42},[47,81,82],{"class":49,"line":50},[47,83,77],{},[33,85],{},"Untuk pengguna CentOS\u002FAlmaLinux\u002FRHEL:",[37,88,90],{"className":39,"code":89,"language":41,"meta":42,"style":42},"dnf install epel-release -y && dnf install clamav clamd rkhunter -y\n",[44,91,92],{"__ignoreMap":42},[47,93,94],{"class":49,"line":50},[47,95,89],{},[33,97],{},[56,99,58],{}," Aplikasi ClamAV dan Rkhunter terpasang dengan sukses di sistem.",[26,102,103,106,108,109],{},[29,104,105],{},"Memperbarui Basis Data Definisi Virus",[33,107],{},"Hentikan sementara layanan pembaru otomatis, lalu perbarui pustaka definisi malware ClamAV secara manual:",[37,110,112],{"className":39,"code":111,"language":41,"meta":42,"style":42},"systemctl stop clamav-freshclam\nfreshclam\nsystemctl start clamav-freshclam\n",[44,113,114,119,125],{"__ignoreMap":42},[47,115,116],{"class":49,"line":50},[47,117,118],{},"systemctl stop clamav-freshclam\n",[47,120,122],{"class":49,"line":121},2,[47,123,124],{},"freshclam\n",[47,126,128],{"class":49,"line":127},3,[47,129,130],{},"systemctl start clamav-freshclam\n",[15,132,134],{"id":133},"ii-prosedur-pemindaian-sistem-menggunakan-clamav-dan-rkhunter","II. Prosedur Pemindaian Sistem Menggunakan ClamAV dan Rkhunter",[11,136,137],{},"Setelah perangkat lunak pemindai siap, jalankan pemeriksaan menyeluruh pada direktori web hosting dan berkas sistem.",[23,139,140,170,202],{},[26,141,142,145,147,148,151,152,155,156,165,167,169],{},[29,143,144],{},"Memindai Direktori Situs Web (Web Root)",[33,146],{},"Jalankan perintah pemindaian khusus pada direktori tempat berkas situs web disimpan (misalnya ",[29,149,150],{},"\u002Fvar\u002Fwww\u002Fhtml"," atau ",[29,153,154],{},"\u002Fhome",") dan simpan laporannya:",[37,157,159],{"className":39,"code":158,"language":41,"meta":42,"style":42},"clamscan -r -i \u002Fvar\u002Fwww\u002Fhtml -l \u002Froot\u002Fclamav_scan.log\n",[44,160,161],{"__ignoreMap":42},[47,162,163],{"class":49,"line":50},[47,164,158],{},[33,166],{},[56,168,58],{}," ClamAV akan memeriksa seluruh berkas secara rekursif dan menampilkan ringkasan berkas yang terinfeksi (Infected files) di akhir proses.",[26,171,172,175,177,178,193,195,197,198,201],{},[29,173,174],{},"Memindahkan Berkas Terinfeksi ke Direktori Karantina",[33,176],{},"Untuk mengisolasi berkas berbahaya secara otomatis agar tidak dieksekusi oleh sistem, jalankan opsi perintah karantina:",[37,179,181],{"className":39,"code":180,"language":41,"meta":42,"style":42},"mkdir -p \u002Froot\u002Fquarantine\nclamscan -r --move=\u002Froot\u002Fquarantine \u002Fvar\u002Fwww\u002Fhtml\n",[44,182,183,188],{"__ignoreMap":42},[47,184,185],{"class":49,"line":50},[47,186,187],{},"mkdir -p \u002Froot\u002Fquarantine\n",[47,189,190],{"class":49,"line":121},[47,191,192],{},"clamscan -r --move=\u002Froot\u002Fquarantine \u002Fvar\u002Fwww\u002Fhtml\n",[33,194],{},[56,196,58],{}," Seluruh berkas yang teridentifikasi mengandung malware akan dipindahkan secara otomatis ke folder ",[29,199,200],{},"\u002Froot\u002Fquarantine",".",[26,203,204,207,209,210,213,214,223,225,227,228,151,231,234],{},[29,205,206],{},"Memeriksa Rootkit pada Sistem Berkas menggunakan Rkhunter",[33,208],{},"Jalankan alat ",[29,211,212],{},"Rkhunter"," untuk memindai potensi adanya rootkit, backdoor, atau perubahan destruktif pada sistem eksekusi bawaan OS:",[37,215,217],{"className":39,"code":216,"language":41,"meta":42,"style":42},"rkhunter --check --sk\n",[44,218,219],{"__ignoreMap":42},[47,220,221],{"class":49,"line":50},[47,222,216],{},[33,224],{},[56,226,58],{}," Sistem akan menjalankan serangkaian pengujian integritas dan memberikan laporan berstatus ",[29,229,230],{},"OK",[29,232,233],{},"WARNING"," jika ditemukan anomali pada berkas sistem.",[15,236,238],{"id":237},"iii-identifikasi-dan-menghentikan-proses-jahat-yang-sedang-berjalan","III. Identifikasi dan Menghentikan Proses Jahat yang Sedang Berjalan",[11,240,241],{},"Malware sering kali menjalankan proses tersembunyi di latar belakang yang mengonsumsi sumber daya CPU atau mengirimkan serangan DDoS\u002Fspam.",[23,243,244,268,290],{},[26,245,246,249,251,252,261,263,264,267],{},[29,247,248],{},"Mengecek Penggunaan Sumber Daya dan Proses Mencurigakan",[33,250],{},"Jalankan perintah analisis proses sistem berikut:",[37,253,255],{"className":39,"code":254,"language":41,"meta":42,"style":42},"top -c\n",[44,256,257],{"__ignoreMap":42},[47,258,259],{"class":49,"line":50},[47,260,254],{},[33,262],{},"Perhatikan proses yang mengonsumsi CPU tinggi atau menggunakan nama acak (seperti baris string acak ",[44,265,266],{},"\u002Ftmp\u002Fx86_64",").",[26,269,270,273,275,276,285,287,289],{},[29,271,272],{},"Mencari Lokasi Berkas Eksekusi dari Proses Jahat",[33,274],{},"Dapatkan nomor Process ID (PID) dari proses mencurigakan tersebut, lalu periksa jalur lokasi berkas aslinya:",[37,277,279],{"className":39,"code":278,"language":41,"meta":42,"style":42},"ls -l \u002Fproc\u002FNOMOR_PID\u002Fexe\n",[44,280,281],{"__ignoreMap":42},[47,282,283],{"class":49,"line":50},[47,284,278],{},[33,286],{},[56,288,58],{}," Terminal akan menampilkan jalur direktori fisik dari mana proses berbahaya tersebut dijalankan.",[26,291,292,295,297,298,307,309,311],{},[29,293,294],{},"Menghentikan Proses Berbahaya Secara Paksa",[33,296],{},"Hentikan proses yang teridentifikasi malware menggunakan perintah penghentian paksa:",[37,299,301],{"className":39,"code":300,"language":41,"meta":42,"style":42},"kill -9 NOMOR_PID\n",[44,302,303],{"__ignoreMap":42},[47,304,305],{"class":49,"line":50},[47,306,300],{},[33,308],{},[56,310,58],{}," Proses jahat akan dihentikan secara seketika dari memori server.",[15,313,315],{"id":314},"iv-pembersihan-otomatisasi-terjadwal-cronjob-jahat-dan-backdoor","IV. Pembersihan Otomatisasi Terjadwal (Cronjob Jahat) dan Backdoor",[11,317,318],{},"Sebagian besar malware memasang mekanisme otomatisasi agar dapat terinfeksi kembali secara otomatis meskipun berkas utamanya telah dihapus.",[23,320,321,359,385],{},[26,322,323,326,328,329,344,346,348,349,151,352,355,356,201],{},[29,324,325],{},"Memeriksa dan Membersihkan Cronjob Pengguna",[33,327],{},"Periksa seluruh daftar penjadwalan tugas pada akun pengguna server:",[37,330,332],{"className":39,"code":331,"language":41,"meta":42,"style":42},"crontab -l\ncrontab -u www-data -l\n",[44,333,334,339],{"__ignoreMap":42},[47,335,336],{"class":49,"line":50},[47,337,338],{},"crontab -l\n",[47,340,341],{"class":49,"line":121},[47,342,343],{},"crontab -u www-data -l\n",[33,345],{},[56,347,58],{}," Layar menampilkan daftar skrip otomatis. Jika terdapat skrip mencurigakan seperti unduhan berbasis ",[44,350,351],{},"curl",[44,353,354],{},"wget"," ke domain luar yang tidak dikenal, hapus entri tersebut menggunakan perintah ",[44,357,358],{},"crontab -e",[26,360,361,364,366,367,376,378,379,151,382,201],{},[29,362,363],{},"Memeriksa Direktori Cron Sistem",[33,365],{},"Periksa berkas cronjob tingkat sistem dengan melihat isi folder sistem berikut:",[37,368,370],{"className":39,"code":369,"language":41,"meta":42,"style":42},"ls -la \u002Fetc\u002Fcron* \u002Fetc\u002Fcrontab\n",[44,371,372],{"__ignoreMap":42},[47,373,374],{"class":49,"line":50},[47,375,369],{},[33,377],{},"Hapus berkas asing atau mencurigakan yang tersimpan di dalam folder ",[29,380,381],{},"\u002Fetc\u002Fcron.d\u002F",[29,383,384],{},"\u002Fetc\u002Fcron.daily\u002F",[26,386,387,390,392,393,402,404],{},[29,388,389],{},"Memeriksa Berkas Sementara (Temp Directory)",[33,391],{},"Periksa direktori umum yang sering digunakan malware untuk menyimpan skrip injeksi:",[37,394,396],{"className":39,"code":395,"language":41,"meta":42,"style":42},"ls -la \u002Ftmp \u002Fvar\u002Ftmp \u002Fdev\u002Fshm\n",[44,397,398],{"__ignoreMap":42},[47,399,400],{"class":49,"line":50},[47,401,395],{},[33,403],{},"Hapus berkas eksekusi berbasis PHP, Perl, atau Shell script yang ditemukan di dalam direktori sementara tersebut.",[15,406,408],{"id":407},"hal-penting-yang-perlu-diperhatikan","Hal Penting yang Perlu Diperhatikan",[410,411,412,418,424,430],"ul",{},[26,413,414,417],{},[29,415,416],{},"Peringatan PENTING - Tindakan Backup:"," Selalu buat cadangan (backup) penuh basis data dan berkas VPS Anda sebelum melakukan tindakan penghapusan berkas. Beberapa skrip pembersih otomatis dapat secara tidak sengaja menghapus berkas aplikasi utama yang terinjeksi kode malware.",[26,419,420,423],{},[29,421,422],{},"Kesalahan Umum (Common Mistake):"," Mengabaikan celah keamanan utama. Membersihkan berkas jahat tanpa memperbarui versi CMS, plugin, atau tema yang rentan (vulnerable) akan menyebabkan VPS Anda terinfeksi kembali dalam waktu singkat.",[26,425,426,429],{},[29,427,428],{},"Pemasangan Firewall Aplikasi Web (WAF):"," Gunakan modul pengaman seperti ModSecurity atau layanan CDN proxy (seperti Cloudflare) untuk menyaring lalu lintas data dan mencegah eksploitasi celah keamanan Remote Code Execution (RCE).",[26,431,432,435,436,439,440],{},[29,433,434],{},"Hardening Konfigurasi PHP:"," Matikan fungsi-fungsi berbahaya pada berkas ",[29,437,438],{},"php.ini"," dengan menambahkan aturan pembatasan berikut:",[37,441,443],{"className":39,"code":442,"language":41,"meta":42,"style":42},"disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source\n",[44,444,445],{"__ignoreMap":42},[47,446,447],{"class":49,"line":50},[47,448,442],{},[450,451,452],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":42,"searchDepth":121,"depth":121,"links":454},[455,456,457,458,459],{"id":17,"depth":121,"text":18},{"id":133,"depth":121,"text":134},{"id":237,"depth":121,"text":238},{"id":314,"depth":121,"text":315},{"id":407,"depth":121,"text":408},"2026-09-10","Panduan ini menjelaskan prosedur untuk mendeteksi, mendiagnosis, dan membersihkan berkas jahat (malware) pada Virtual Private Server (VPS) melalui terminal...","md",false,{},true,null,"\u002Fpanduan\u002Fvps\u002Fcara-scan-dan-mengatasi-vps-yang-terdeteksi-malware",{"title":6,"description":461},{"loc":467},"panduan\u002Fvps\u002Fcara-scan-dan-mengatasi-vps-yang-terdeteksi-malware","Y41LwnaXW-m3svp6iWbdWHtsihYJa2L2754rd3KexkE",{"id":473,"title":42,"body":474,"description":478,"extension":462,"meta":479,"name":480,"navigation":465,"path":481,"seo":482,"stem":483,"__hash__":484},"knowledgeBaseCategories\u002Fpanduan\u002Fvps\u002Findex.md",{"type":8,"value":475,"toc":476},[],{"title":42,"searchDepth":121,"depth":121,"links":477},[],"Pengelolaan akun _VPS_ secara umum.",{},"VPS","\u002Fpanduan\u002Fvps",{"description":478},"panduan\u002Fvps\u002Findex","OY43n-_eRXCpFgpOE94SqjGk4J7e1-IXWvMwMNin6Qs",1793089351300]