My father owns a NAS by Synology. I have a sneaking suspicion that it might have been infected by some form of malware. I noticed for example it often increasing in overall and specifically fan noise at odd times and when nobody is using it.
What are tools I can use to scann it for unwanted intruders and if found get rid of them?
Synology?
SSH in and run top. See what it’s doing. You could compare the checksum of the binaries that are running to make sure that they’re the real binaries, if you really want to get into it.
But if I had to guess, it’s either running a backup or re-running its indexing.