FXVPS
Get Started
vps security windows antivirus metatrader

Antivirus on a Trading VPS: What to Run, What to Exclude, and What to Leave Alone

person
FXVPS
Share
Antivirus on a Trading VPS: What to Run, What to Exclude, and What to Leave Alone

There is a specific, maddening failure mode that catches traders about once a quarter. An EA that has run flawlessly for months suddenly stops trading. The terminal is open. AutoTrading is green. The chart is updating. But the smiley face on the EA is gone, and the Experts tab shows nothing. Somewhere in the logs, hours ago, Windows Defender decided the compiled .ex4 file looked like a threat and quietly moved it to quarantine.

Nobody told you. Defender does not push a notification to an RDP session you were not logged into. The EA simply stopped existing, and the strategy stopped running, and you found out when you checked the account two days later.

This is the antivirus problem on a trading VPS. It is not that antivirus is bad — running an internet-facing Windows Server with no protection at all is worse. It is that the default configuration was designed for an office laptop, and a trading VPS is not an office laptop. Here is how to configure it properly.

Why Trading Software Trips Antivirus Heuristics

Compiled MQL4 and MQL5 files, DLL-based EA components, copiers, and bridge software all exhibit behaviours that look, to a heuristic scanner, exactly like malware:

  • They are small compiled binaries from an unknown publisher with no code-signing certificate
  • They make outbound network connections to non-standard ports
  • They write to files in program directories at runtime
  • They may inject into or communicate with other processes (copiers especially)
  • They are often obfuscated deliberately, because commercial EA vendors protect their logic

Every one of those is a legitimate thing for trading software to do. Every one of those is also on the checklist a behavioural scanner uses to identify a trojan. The overlap is not a bug in Defender; it is an unavoidable consequence of what EAs are.

⚠️ Warning: The most dangerous version of this is silent. Defender’s default action for a medium-confidence detection is to quarantine without an interactive prompt, because there is no interactive user on a server. Your EA disappears and nothing tells you. Always check quarantine history when an EA “just stopped working” for no reason.

The Second Problem: Scans During Market Hours

Even when antivirus is not eating your files, it may be eating your CPU. Windows Defender runs a scheduled scan by default. On a 1 vCPU VPS, a full scan can consume most of the available processor for twenty minutes or more.

If that scan happens to land at 08:00 London or 13:30 UK — the exact windows where your EA needs to evaluate ticks and place orders promptly — you have introduced latency into your own execution path for no reason. The market does not pause while your machine indexes itself.

📊 Key Stat: A full Defender scan on a small Windows Server instance typically consumes 40-80% of one vCPU for 15-40 minutes depending on disk contents. On a single-core plan, that is your EA’s compute budget being spent on scanning files that have not changed since the last scan.

What to Actually Do: The Configuration

1. Keep Real-Time Protection On

Start here, because the instinct to turn it all off is wrong. A trading VPS with RDP exposed is a target. Brute-force attempts against port 3389 are constant background noise on the internet. Defender is one of several layers that keeps a compromised session from becoming a compromised machine, and a compromised machine is a machine where someone else can place trades on your account.

Do not disable real-time protection. Configure it.

2. Add Path Exclusions for Your Trading Directories

This is the fix for the quarantine problem. Exclude the directories where trading software actually lives, and only those directories.

For MetaTrader, the paths you care about are the installation directory and — importantly — the data directory, which is not the same place. In MT4 or MT5, open File → Open Data Folder to find the real location. It is usually under C:\Users\<you>\AppData\Roaming\MetaQuotes\Terminal\<long hex string>\. Your MQL4\Experts and MQL5\Experts folders live there, and that is where quarantine actually strikes.

To add exclusions:

  1. Open Windows Security → Virus & threat protection
  2. Under Virus & threat protection settings, click Manage settings
  3. Scroll to Exclusions and click Add or remove exclusions
  4. Add a Folder exclusion for each MetaTrader installation directory
  5. Add a Folder exclusion for each MetaTrader data directory
  6. Add exclusions for any copier, bridge or plugin installation directories

3. Add Process Exclusions Sparingly

Path exclusions handle most cases. A process exclusion — telling Defender to ignore what a specific executable does at runtime — is a bigger hammer and should be used only when a path exclusion does not solve the problem. Copiers that inject into terminal processes sometimes need this. A plain EA does not.

4. Move the Scheduled Scan Off Market Hours

Set the scan to run at a time when you are not trading. For a forex trader, the natural window is the weekend — the market is closed from Friday evening to Sunday evening and nothing is at risk.

In Task Scheduler, navigate to Microsoft → Windows → Windows Defender and open Windows Defender Scheduled Scan. On the Triggers tab, set a weekly trigger for Saturday. On the Conditions tab, uncheck the options that would let it start at an unpredictable time.

💡 Tip: If you cannot get the scheduled task to behave, the blunt alternative works: leave real-time protection on and disable the scheduled full scan entirely. Real-time protection catches things as they arrive, which is the part that matters. The weekly full scan is largely redundant on a machine that only ever runs three programs.

5. Do Not Install a Third-Party Antivirus Suite

This is the mistake that turns a manageable problem into an unmanageable one. Consumer antivirus suites — the ones with firewalls, browser extensions, “optimisers” and VPN bundles — are heavy, opinionated, and hostile to exactly the software you are trying to run. On a 2GB VPS they can consume a third of your available memory doing nothing useful.

Windows Defender is built in, free, well-integrated, and configurable. It is the right choice on a trading VPS, and it is the one FXVPS instances ship with.

🚀 Try FXVPS free for $1.99 — get 7 days on the Core VPS risk-free on a Windows Server build that is already configured for trading. No long-term commitment, cancel anytime.

The Thing Antivirus Will Not Save You From

Worth being blunt: the realistic threat to a trading VPS is not a virus. It is a weak RDP password.

Automated scanners find port 3389, try common credentials, and if they succeed they have your desktop — with your terminal already logged in and AutoTrading enabled. No antivirus product prevents someone from logging in with the correct password.

The controls that actually matter:

  • A long, unique RDP password. Not reused from anywhere else. Twenty-plus characters.
  • Change the RDP port from the default 3389 to something non-obvious. This does not stop a targeted attacker but eliminates the vast majority of opportunistic scanning.
  • Restrict RDP by source IP where your connection is stable enough to allow it.
  • Keep Windows patched. RDP has had genuine remote-code-execution vulnerabilities; patching is what closes them. Our Windows updates guide covers doing this without a reboot landing mid-session.
  • Do not use the VPS as a general browser. The most common way trading machines get infected is a trader downloading a “free EA” from a forum link. Antivirus configured with exclusions on your MetaTrader folder will not catch a malicious EA you deliberately installed into that folder.

Our full VPS security hardening guide for traders walks through each of these.

✅ Best Practice: Treat any EA you did not write or buy from a reputable vendor as untrusted, and run it on a demo account on a separate terminal for a week before it goes anywhere near live capital. Read the Experts and Journal tabs during that week. An EA that phones home to an unexpected address, or that tries to read files outside its own directory, will show itself.

A Diagnostic Checklist: “My EA Stopped For No Reason”

When an EA silently stops, work through this in order before assuming a code problem:

  1. Check Defender’s protection history. Windows Security → Virus & threat protection → Protection history. Quarantined items appear here with timestamps. This is the check almost nobody performs first, and it is the one that most often finds the answer.
  2. Confirm the .ex4 or .ex5 file still exists in the data folder’s Experts directory. If it is gone, you have your culprit.
  3. Check the Experts tab in the terminal for load errors around the time trading stopped.
  4. Check whether Windows restarted. An unattended update reboot restarts the machine but not necessarily your terminal, unless auto-start is configured.
  5. Check the terminal’s Journal tab for disconnections that coincide with the stop.

Our guide to EAs that stop working on a VPS covers the wider set of causes once antivirus is ruled out.

Summary

The correct antivirus posture on a trading VPS is neither “turn it all off” nor “leave the defaults alone”. It is:

  • Keep Windows Defender real-time protection on
  • Add folder exclusions for every MetaTrader installation directory and data directory, plus any copier or bridge
  • Move the scheduled scan to the weekend, or disable the full scan and rely on real-time protection
  • Do not install a third-party consumer antivirus suite
  • Spend your actual security effort on RDP hardening, because that is where the real risk is

Ten minutes of configuration eliminates a failure mode that can silently cost you a month of strategy performance. It is the cheapest reliability work available on a trading VPS.

Compare plans at /pricing/ or start on a $1.99 seven-day trial.

Frequently Asked Questions

Should I disable Windows Defender on my trading VPS?

No. Disable the scheduled full scan if it interferes with market hours, and exclude your trading directories from scanning, but leave real-time protection enabled. An internet-facing Windows Server with no protection is a genuinely bad idea.

Why did Windows Defender delete my EA?

Compiled EA files are small, unsigned binaries from unknown publishers that make network calls and write to program directories — the same behavioural profile as malware. Heuristic detection flags them as a false positive. A folder exclusion on your MetaTrader data directory prevents it.

Which folders should I exclude?

The MetaTrader installation directory and the MetaTrader data directory (File → Open Data Folder in the terminal — they are different locations), plus the installation directory of any copier, bridge or plugin. Exclude directories, not whole drives.

Will antivirus slow down my EA?

A scheduled full scan will, noticeably, on a 1 vCPU plan — it can consume most of a core for tens of minutes. Real-time protection with proper exclusions has negligible impact on a running EA.

Is a third-party antivirus better than Windows Defender for a VPS?

For trading, no. Consumer suites use significantly more RAM and CPU, are more aggressive about flagging trading software, and add components (bundled firewalls, browser extensions, VPNs) that a trading VPS has no use for. Defender is lighter and easier to configure correctly.

What is the actual biggest security risk on a trading VPS?

A weak or reused RDP password. Antivirus does not stop someone who logs in with valid credentials. Password strength, a non-default RDP port, IP restrictions and Windows patching do far more for your security than any scanner configuration.