Recommended Free Tools
If a Minecraft plugin JAR looks malicious, treat the event as a server incident—not a routine plugin problem. Stop the Minecraft server, connected proxies, and related services; preserve a copy of the files and logs; scan every server and proxy offline; remove every flagged or untrusted JAR; rotate credentials; and rebuild the host when an attacker may have reached the operating system. Deleting one plugin and restarting is not enough to establish that the environment is clean.
Godlike.Host offers hosted Minecraft Java servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.
What a compromised Minecraft server can look like
Malware on a Minecraft network may be hidden inside a plugin JAR, spread through more than one server, or leave changes outside the Minecraft directory. Symptoms can be subtle because a malicious plugin may continue providing its advertised feature while performing another task in the background.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Unexpected plugin updates, unfamiliar JARs, or files obtained from unofficial mirrors.
- Unexplained outbound connections, bandwidth use, CPU load, or memory consumption.
- New operators, permission changes, accounts, scheduled tasks, or modified startup scripts.
- Commands appearing in console or logs that no administrator recognizes.
- Restarts, crashes, or configuration changes that begin shortly after a plugin installation or update.
- Security software alerts naming a plugin, especially when the alert appeared after a signature update.
None of these signs alone proves malware. A generic antivirus detection can be a false positive, while a clean antivirus result does not prove that a server is safe. The reliable response combines containment, file provenance, hashes, scanner results, log timelines, and a decision about whether the host itself may have been accessed.
Contain the incident before investigating
Stop every process that can execute the suspected code
Stop the affected Minecraft process immediately. Also stop connected proxies, wrappers, scheduled restart services, control-panel agents, and any related service that can launch the server or load its plugins. Do not keep restarting the server to see whether a symptom disappears; every restart can execute the same code again and overwrite useful evidence.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Keep all affected servers and proxies offline until the initial scan and evidence copy are complete. If several instances share a host, network storage, or plugin directory, treat them as part of the same incident rather than isolating only the instance where the first symptom appeared.
Preserve a forensic copy
Before deleting anything, copy the complete server directory to offline storage. Include plugin JARs, configuration files, startup scripts, the current log, rotated logs, crash reports, proxy files, and any system or authentication logs that can show access to the host. Preserve file timestamps and names where possible. Keep the copy read-only and separate from the machine being cleaned.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
At minimum, preserve:
- Every
.jarin each server and proxy plugin directory. logs/latest.log, which PaperMC identifies as the newest server log.- Rotated logs, console output, crash reports, and panel audit records.
- Operating-system authentication logs, scheduled-task data, firewall records, and service definitions.
- Hashes or checksums for each file before removal.
Retain the scanner’s own output as evidence. MCAntiMalware documents a sequence of stopping the server, running java -jar MCAntiMalware.jar, and reviewing the generated AntiMalware/logs directory.
Inventory the entire network, not just the server showing symptoms
Make a written inventory before scanning. List every Minecraft server, proxy, host, container, plugin directory, and JAR. Record where each file came from, when it was installed or updated, and its checksum. Include offline or rarely used instances: an attacker may plant a copy where it will execute later.
Repeat the scan across every server and proxy in the network. The Spigot incident procedure specifically calls for scanning all servers and proxies, not only the machine where the alert first appeared. If a proxy forwards players to several backends, inspect both the proxy’s plugins and every backend’s plugins.
Build a file and provenance checklist
- Does the JAR name match a plugin you intentionally installed?
- Was it downloaded from the project’s official page or an established repository?
- Does its version match the release you selected?
- Does its checksum match a known-good copy from that release?
- Was it copied to another server or proxy?
- Did its installation coincide with a restart, new account, permission change, or outbound connection?
A JAR that cannot be tied to a deliberate installation should be treated as untrusted until proven otherwise. Do not keep it merely because the server appears to need it.
Scan offline with Minecraft-aware tools
Use a dedicated plugin scanner
MCAntiMalware’s listing says it can scan directories and detect more than 1,000 malicious plugins. Its version 15.16 listing was updated September 4, 2025. Run it only after the server and proxies are stopped so the files cannot execute while you inspect them.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Stop every affected Minecraft server, proxy, and related launcher or restart service.
- Work from the preserved copy or a controlled clone when practical; keep the original evidence untouched.
- Run
java -jar MCAntiMalware.jarfrom the directory containing the scanner. - Review the generated
AntiMalware/logsdirectory and record every detection, file path, and reason reported. - Run the scan against each plugin and proxy directory in your inventory.
- Save the scanner output with your file hashes and incident timeline.
A plugin scanner is valuable for identifying suspicious JAR patterns and known malicious files, but it cannot certify the host operating system after an attacker has obtained host access. Treat a clean scan as one piece of evidence, not a complete clearance.
Correlate scanner findings with behavior
For each flagged file, compare the scanner result with:
- Its origin and checksum.
- Its install and update time.
- Log entries immediately before and after installation.
- New network destinations or unusual connection times.
- Changes to operators, permissions, startup scripts, scheduled tasks, or user accounts.
PaperMC notes that malware can spread through compromised plugin-author accounts and may be difficult to detect. An apparently legitimate plugin name, publisher, or version number is therefore not sufficient proof of safety if the download source or checksum is wrong.
Interpret antivirus alerts without overreacting—or ignoring them
Spigot warns that generic antivirus software can falsely report Java plugins as malware. Its platform notice says: “A recent Windows Defender signature change has caused very many plugins to be falsely reported as malware, usually as ‘Trojan:Script/Wacatac.B!ml’.” A single Defender or other endpoint alert is a lead, not a verdict.
Raise confidence when at least one independent signal agrees:
- A Minecraft-specific scanner flags the same JAR.
- The checksum differs from the official release.
- Decompilation or code review reveals unexpected loading, command execution, credential collection, or network behavior.
- The file came from an unofficial mirror or a publisher account known to have been compromised.
- Logs or network monitoring show activity that the plugin’s documented purpose does not require.
Lower confidence in an alert only when you can reproduce the result against a verified official JAR, compare its checksum, and find no suspicious behavior. Do not create an antivirus exclusion simply to get the server running again.
Remove malicious or untrusted plugins safely
Delete every affected copy
With the server and proxies still offline, remove every flagged JAR and every copy that cannot be trusted. Search all plugin directories, backup staging areas, proxy directories, containers, and alternate server instances. Removing only the copy named in an alert leaves an easy route for reinfection.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Keep the original files in the preserved evidence copy. Delete or quarantine the executable copies from the environment that will be restored. Do not execute a JAR to test whether it is safe.
Download replacements from trusted project pages
Obtain clean replacements from the plugin’s official project page or an established repository. PaperMC identifies Hangar, Modrinth, and BukkitDev as plugin sources and directs administrators toward official plugin sources. Verify the project name, version, publisher, release notes, and checksum before copying a replacement into a server.
Do not restore executable JARs or startup scripts from an unknown backup. A backup is useful only if you know when it was created, where it came from, and that it predates the compromise or has been inspected.
Rescan before the first restart
- Place only the verified replacement JARs in a clean staging directory.
- Run the scanner against that complete set, including proxy plugins.
- Compare the resulting file list with your inventory and confirm that no unexpected JAR remains.
- Check configuration and startup scripts for added commands, remote downloads, or altered paths.
- Start the server only after the clean set and its evidence record are complete.
Assume credentials are exposed when the host may have been reached
A malicious plugin can expose secrets available to the Minecraft process. If the attacker may have obtained operating-system access, the risk is broader: panel credentials, SSH or FTP accounts, database passwords, RCON secrets, bot tokens, and credentials stored in scripts or environment files may all be compromised.
From a separate, trusted machine:
- Rotate panel, SSH, FTP, database, RCON, Discord-bot, and Minecraft credentials.
- Invalidate API keys, session tokens, deploy keys, and bot tokens rather than merely changing their labels.
- Review newly created users, operators, permissions, SSH keys, scheduled tasks, and service accounts.
- Revoke access for people or integrations that no longer need it.
- Change shared passwords anywhere else they were reused.
Do not rotate secrets from the potentially compromised host; a keylogger or malicious process could capture the replacements.
When to rebuild the operating system
Deleting a malicious plugin is not enough if an attacker had host access. The Spigot incident guidance recommends backing up data and reinstalling the operating system after removing malicious JARs because the original plugin may have created persistence elsewhere.
Rebuild from trusted installation media when you cannot establish that the compromise was confined to a JAR, or when you find altered system services, users, scheduled tasks, startup scripts, SSH keys, or other host-level changes. A rebuild should include:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Preserving evidence and vetted data before wiping the host.
- Installing the operating system from trusted media.
- Applying current security patches before exposing the machine to players.
- Installing the server software and required runtime from trusted sources.
- Restoring only inspected worlds, configuration, and non-executable data.
- Installing verified plugins and scanning the final set before launch.
- Recreating least-privilege accounts and rotating credentials again if they were present during the compromise.
If you choose not to rebuild, document why the evidence supports a plugin-only compromise and apply equivalent host checks. Uncertainty about persistence is itself a reason to rebuild.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Restore backups without restoring the infection
PaperMC’s troubleshooting guidance begins with “Stop Your Server And Take A Backup.” A functioning, separate backup is essential, but not every backup is safe to restore. Preserve a known-good copy of worlds and configuration while the incident is investigated, then inspect the backup before use.
- Identify the backup’s creation time and storage location.
- Check whether the backup contains plugin JARs, startup scripts, or other executable content.
- Scan and review those files before restoring them.
- Prefer restoring world data and vetted configuration separately from executable components.
- Keep an untouched copy in case later evidence changes your assessment.
Never let a convenient restore overwrite the evidence copy or reintroduce an untrusted plugin.
Start the recovered server cautiously
After the clean rebuild or verified plugin replacement, start one server at a time. Use least-privilege service accounts, restrict administrative access, and keep proxies and backends separated until each has passed its checks.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWatch logs/latest.log and rotated logs closely after startup and after every plugin update. PaperMC recommends watching server logs after updates. Also monitor outbound connections, resource use, account changes, operator assignments, permission changes, and unexpected restarts. A clean first launch is not proof that persistence is absent; continued observation is part of recovery.
Choose the right level of response
| Response or evidence | What it contributes | Important limitation | When to use it |
|---|---|---|---|
| Offline Minecraft-plugin scan | Finds suspicious JAR patterns and known malicious plugins; MCAntiMalware supports directory scanning. | Cannot prove the host operating system is clean after host access. | Every suspected incident, before removal and before restart. |
| Generic endpoint antivirus | Provides an additional malware signal for the host and files. | Java plugins can be falsely flagged, including the Wacatac.B!ml alert described by Spigot. | Use as a complementary control and corroborate the result. |
| Logs, hashes, and provenance review | Creates a reproducible timeline and helps distinguish an official release from a modified copy. | Evidence collection does not remove persistence. | Always, especially when deciding whether a detection is a false positive. |
| Credential rotation | Limits damage from exposed passwords, tokens, keys, and service secrets. | Does not remove malicious files or host-level persistence. | Whenever the plugin or host could read credentials. |
| Operating-system rebuild | Removes unknown host-level changes and provides a trusted base for reinstallation. | Requires downtime and careful data restoration. | When host access or persistence cannot be ruled out. |
NIST describes antivirus, spyware-removal tools, intrusion prevention, and firewalls as complementary controls with limitations. A Minecraft-specific scanner and general endpoint controls serve different purposes; neither replaces incident response.
Threats that look like ordinary server problems
Microsoft has documented MCCrash, a botnet targeting private Minecraft servers with server and Minecraft commands, and described Defender detections for the malware involved. That context matters when a server suddenly shows unusual resource use, command activity, or network behavior. Treat those changes as potentially hostile until logs, file provenance, and host evidence explain them.
A performance spike may be a bug or a botnet workload. A new command may be an administrator or an attacker. The distinction comes from correlating timestamps, accounts, plugin changes, network connections, and checksums—not from the symptom alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common recovery mistakes and how to avoid them
Restarting before copying logs
Repeated restarts can overwrite the event sequence and execute the suspected JAR again. Stop first, preserve logs/latest.log and rotated logs, then scan.
Scanning only the server named in the alert
Compromised files may exist on another backend, proxy, container, or staging directory. Build an inventory and repeat the scan everywhere.
Trusting a familiar plugin name
An attacker can use a legitimate project name, a modified release, or a compromised publisher account. Verify the source, version, checksum, and behavior.
Deleting the JAR and keeping the same credentials
If the plugin could read secrets, assume those secrets were exposed. Rotate them from a clean machine and invalidate tokens.
Restoring a complete old backup
An old backup may contain the same malicious JAR or altered startup script. Restore inspected data and reinstall executable components from trusted sources.
Calling the host clean after one scanner reports no findings
A plugin scanner can miss persistence outside the Minecraft directories. If host access is plausible, rebuild the operating system or perform a documented host-level investigation before declaring recovery complete.
Post-recovery checklist
- All servers, proxies, and launch services were stopped during preservation and scanning.
- A separate evidence copy contains the original JARs, configurations, logs, and relevant host records.
- Every server and proxy directory was inventoried and scanned.
- Flagged and untrusted JARs were removed from every copy.
- Replacement plugins came from official project pages or established repositories and were rescanned.
- Panel, SSH/FTP, database, RCON, bot, and Minecraft credentials were rotated from a clean machine.
- Tokens, keys, new accounts, operators, permissions, and scheduled tasks were reviewed.
- Only inspected data was restored; unknown executable files were excluded.
- The operating system was rebuilt when host access or persistence could not be ruled out.
- Logs, outbound traffic, resource use, and account changes are being watched after recovery and updates.
Bottom line
A suspicious Minecraft plugin is an incident until evidence shows otherwise. Contain first, preserve evidence, scan every server and proxy offline, verify provenance and hashes, remove every untrusted JAR, rotate exposed credentials, and rebuild the host when persistence is possible. Keep separate backups and continue monitoring after the first clean startup; recovery is complete only when both the executable files and the environment that ran them are trustworthy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
