send a popular trojan to the server... if it executes and sends back a confirmation message, it has no antivirus
for detecting firewall, scan its ports with software to find if all the commonly used ports are closed. if they are, there is a firewall.
more info cannot be told here due to the rules of this forum. google. your best friend. and your worst enemy.