Selfhosted

First, a caveat: fan noise spiking at odd hours is often just DSM doing its own housework (scheduled tasks run by default in the middle of the night — indexing photos, deduplication, etc.). Check Control Panel → Task Scheduler before assuming malware; if the noisy jobs are legit DSM ones, that's your answer.

If you still want to verify the box is clean, since Synology DSM is basically a locked-down Linux under the hood:

1. Check what's actually listening and running. SSH in (enable it in Control Panel → Terminal) and run sudo netstat -tulpn and ps aux. Anything unfamiliar with no package owner is a red flag. synowebapi/synology prefixed processes are normal.

2. Check persistence points: crontab -l and /etc/crontab, plus ~/.ssh/authorized_keys for all users — malware loves adding a key.

3. Log review: DSM's Log Center will show auth failures. A wall of failed SSH logins from random IPs just means the NAS is internet-exposed — which is a fixable problem in itself (move SSH to a non-standard port or better, keep it LAN-only and use Tailscale/WireGuard for remote access).

4. Full scan: Synology has a built-in malware scanner (Security Advisor / synoscan), but it's fairly shallow. A stronger option is running ClamAV on a separate machine pointed at a read-only mount of the shares — clamscan -r --bell -i /mnt/nas — which catches infected files (Windows-targeting stuff mostly) even if the NAS itself isn't compromised.

5. If you find something you can't explain: the safest move on a NAS is a config backup, a full DSM reinstall, and data restore — chasing a rootkit on an appliance is not worth it.

One hardening tip regardless of outcome: disable admin SSH + port-forwarding to the NAS entirely, and don't expose DSM to the internet directly (use quickconnect or a VPN tunnel instead).