Security & AntiMalware

Overview#

Arqonara runs a Semi-Transparent Anti-Virus system that works automatically at the server (backend) level. It is designed to protect our infrastructure and users' services from malicious software that often hides inside plugins or modified files.

The system works natively in a Pterodactyl/Wings environment and performs a deep scan before the server starts — not just a claim, but genuinely running automatically.

This AntiMalware system was built by Vanes (AntiVirus Maintainer).

How It Works#

Here is the workflow of how our security system detects and handles threats:

1. Environment Initialization — When a server is about to start, the entrypoint collects metadata from the Wings/Pterodactyl environment: Server UUID, Group, and Node ID. The data is held temporarily in memory for verification.
2. Deep Scanning — The system opens and reads every .jar file inside the plugins directory, then performs a path search to find anomalies in the Java file structure.
3. Heuristic Detection — The system looks for suspicious patterns that should not exist in standard (Maven/Shading) plugins:
   • Code Injector: scripts that try to inject malicious code into other processes.
   • Suspicious Obfuscator: compilation patterns deliberately disguised to hide malware.
   • Hidden Executables: executable files (.exe/binary) embedded inside .jar archives.
4. Enforcement — If a potentially dangerous plugin is found (flagged):
   • Logging: the plugin data is recorded into the main task memory.
   • Action: runs RENAME (rename the file), DELETE (remove the file), or CRASH.
   • Alerting: incident logs are automatically sent to the Arqonara administration team via Discord.
5. Startup Validation
   • If a virus is found: the server is forced to stop (Force Crash) to prevent malicious code from running.
   • If safe: the server continues its normal startup without interruption.

Runtime Protection#

Protection does not stop once the server is running. The system has a Watcher mechanism that stays active while the server runs: