My father owns a NAS by Synology. I have a sneaking suspicion that it might have been infected by some form of malware. I noticed for example it often increasing in overall and specifically fan noise at odd times and when nobody is using it.
What are tools I can use to scann it for unwanted intruders and if found get rid of them?
Synology?
SSH in and run top. See what it’s doing. You could compare the checksum of the binaries that are running to make sure that they’re the real binaries, if you really want to get into it.
But if I had to guess, it’s either running a backup or re-running its indexing.
I went down that rabbit hole too when I thought it should have been idle. Turned out it was routine data integrity checks and indexing.
Ages ago Synology used to have (maybe still does) a virus scan utility based on clamav (I thiiiiiink) and it only found windows viruses I had in spam emails on my Mac backups.