close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Port Security
- play_arrow Port Security Overview
  - Overview of Port Security
play_arrow IPSec
- play_arrow Understanding IPsec and Security Associations
- play_arrow IPsec Configurations and Examples
- play_arrow Configuring IPsec Security Associations
- play_arrow Using Digital Certificates for IPsec
- play_arrow Additional IPsec Options
- play_arrow Configuring IPsec Dynamic Endpoints
- play_arrow Additional ES and AS PIC Configuration Examples
play_arrow Digital Certificates
- play_arrow Configuring Digital Certificates
- play_arrow Configuring SSH and SSL Router Access
play_arrow Trusted Platform Module
- Trusted Platform Module Overview
play_arrow MACsec
- play_arrow Understanding MACsec
  - Understanding Media Access Control Security (MACsec)
  - Media Access Control Security (MACsec) over WAN
- play_arrow MACsec Examples
play_arrow MAC Limiting and Move Limiting
- play_arrow MAC Limiting and Move Limiting Configurations and Examples
play_arrow DHCP Protection
play_arrow IP Source Guard
- play_arrow Understanding IP Source Guard
- play_arrow IP Source Guard Examples
play_arrow IPv6 Access Security
- play_arrow Neighbor Discovery Protocol
  - IPv6 Neighbor Discovery Inspection
- play_arrow SLAAC Snooping
  - IPv6 Stateless Address Auto-configuration (SLAAC) Snooping
- play_arrow Router Advertisement Guard
play_arrow Control Plane Distributed Denial-of-Service (DDoS) Protection and Flow Detection
- play_arrow Control Plane DDoS Protection
- play_arrow Flow Detection and Culprit Flows
play_arrow Unicast Forwarding
- play_arrow Unicast Reverse Path Forwarding
- play_arrow Unknown Unicast Forwarding
  - Understanding and Preventing Unknown Unicast Forwarding
play_arrow Storm Control
- play_arrow Understanding and Using Storm Control
play_arrow Malware Protection
- play_arrow Juniper Malware Removal Tool
  - Juniper Malware Removal Tool
  - How to use the Juniper Malware Removal Tool
play_arrow Configuration Statements and Operational Commands
- Security Services Configuration Statements
- Junos CLI Reference Overview

list Table of Contents

English

How to use the Juniper Malware Removal Tool

date_range 24-Jan-24

arrow_backward

arrow_forward

You can use the Juniper Malware Removal Tool (JMRT) to scan for and remove malware running on Juniper Networks devices. You can run two types of scans— quick scan and integrity check. You can also run test scans that check for fake malware. Use Feature Explorer to confirm platform and release support for specific features.

Run a Quick Scan

You can use JMRT to run a quick scan to check for and remove malware on your system.

To run a scan on all the processes currently running on the system, use the request system malware-scan quick-scan command.
JMRT identifies processes and files containing malware and deletes them. Ideally, your device is free of malicious files and processes, and JMRT does not identify any process as potential malware, as seen in the following example:
```
user@host> request system malware-scan quick-scan 
Found potential malware: No
```
If JMRT identifies a file or process as potential malware, it displays the process ID and location of the malware and then deletes it.
For example:
```
user@host> request system malware-scan quick-scan
Found potential malware: Yes
Scan Results:
Rule: tsb.auction-file/noclient
   pid:  95417
   file: /tmp/hidden/ssh
```
To scan specific processes, use the pids option with quick-scan to specify the processes that need to be scanned.
This method is faster than a general scan because JMRT does not scan every single process that is running on the system.
In the following example, JMRT scans only processes with process IDs (PIDs) 42 and 97.
```
user@host> request system malware-scan quick-scan pids [ 42 97 ]
Found potential malware: No
```
Use the clean-action option to indicate the action to take if malware is identified.
The default is clean, which removes malicious files and processes. The warn action informs the user about malware but does not remove it.
In this example, JMRT scans process 26329 and notifies the user if it is malware but does not delete the process.
```
user@host> request system malware-scan quick-scan pids 26329 clean-action warn 
Found potential malware: No
```
In this example, JMRT scans process 26315 and deletes it if it is malware.
```
user@host> request system malware-scan quick-scan pids 26315 clean-action clean
Found potential malware: No
```

Run an Integrity Check

You can use JMRT to check whether integrity mechanisms are enabled and working properly.

Run the request system malware-scan integrity-check command.

For example:

content_copy zoom_out_map
user@host> request system malware-scan integrity-check
Integrity is enforced: Yes

Note:

From Junos OS Release 19.2 through Release 21.3, integrity-check was called veriexec-check. We changed the command name in Junos OS Release 21.4 to reflect that different integrity mechanisms might be used on different platforms (for instance, Junos OS uses Veriexec, whereas Junos OS Evolved uses Integrity Measurement Architecture, or IMA).

Run a Test Scan

Using JMRT, you can run fake malware processes on the system and use them for testing purposes. These processes are not actually malicious, but you can use them to observe how JMRT behaves when it identifies malware.

The test commands are available by default in Junos OS Evolved. To use these commands in Junos OS, you must install the optional jmrt-test package.

Note:

Use the following commands to install the jmrt-test package:

For Junos OS Release 20.1R1 or later:
request system software add optional://jmrt-test
For Junos OS releases before Release 20.1R1 (with 64-bit Routing Engine):
request system software add optional://jmrt-test-x86-64.tgz
For Junos OS releases before Release 20.1R1 (with 32-bit Routing Engine):
request system software add optional://jmrt-test-x86-32.tgz

(Optional) Use JMRT to create a fake malware process.

content_copy zoom_out_map
user@host> request system malware-scan run-fake-malware
Fake malware PID: 25855

(Optional) View a list of the process IDs of all the fake malware that are currently running on the system.
```
user@host> request system malware-scan list-fake-malware 
Example malware PIDs:
 25855
 25857
```
Run a test scan for fake malware by using the test option with the quick-scan statement.
The following example runs a test scan on processes 25855 and 25857, which are fake malware processes that were created earlier.
```
user@host> request system malware-scan quick-scan test pids [ 25855 25857 ]
Scan Results:
 Rule: test-malware/fake-jmrt-malware
 pid: 25855
 file: /packages/mnt/jmrt-test-x86-6464-74a7b298/opt/jmrt/example/fake-jmrt-malware
 Rule: test-malware/fake-jmrt-malware
 pid: 25857
 file: /packages/mnt/jmrt-test-x86-6464-74a7b298/opt/jmrt/example/fake-jmrt-malware
```
Note:
You must use the test option because normal scans do not check for fake malware.

arrow_backward PREVIOUS Juniper Malware Removal Tool

NEXT arrow_forward Security Services Configuration Statements

Security Services Administration Guide

ON THIS PAGE