FiveM malwaremalware scanner

In your FiveM server folder, the one with resources in it (or in resources itself). Either:

• open PowerShell in that folder and paste the command, or
• download the .bat, move it into the folder and double-click it.

It runs on Windows servers. The command and the .bat are good for one scan, for 30 minutes.

A script hidden inside a resource, usually one from a leak or piracy site, that gives someone else control of your server. Most phone home to a command-and-control panel such as cipher-panel or Blum panel: they can run code on your server, add txAdmin admins, steal your database credentials and server key, and push the backdoor into your other resources.

Common signs:

• txAdmin admins or resources you didn’t add
• players getting banned, kicked or given items for no reason
• outbound requests to domains you don’t know in your server console
• your server key or database password leaking

Run the scanner to check your files for the known backdoors.

Start with the Malware results. For each one:

1. Delete the infected resource and replace it with a clean copy from its original author.
2. Run the scan again, since backdoors copy themselves into other resources.
3. Change your txAdmin passwords, your server key and your database password, and remove txAdmin admins you don’t know.

Suspicious and Network results are often legitimate code. Each one says what to check.

It’s FiveM’s way for a script to call a website, which plenty of good resources do (Discord webhooks, license checks). Backdoors use it too, to send your data out, so it’s listed as Network: look at the address it calls. If it’s Discord, your own site or the resource author’s, it’s fine.

Yes, with no account and no limit on how often you scan.

Yes. Below a finished scan, Copy share link gives you a link to the report for your developer or a support team.