Powerful, highly stealthy Linux trojan may have infected victims for years

Post by etcet » Tue, Dec 09, 2014, 11:23 PM UTC

Bill_Dimm wrote: post #98

etcet wrote: post #20

Earlier quoted context omitted.

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

This seems to get stuck for me after a few minutes (grep stops taking up CPU cycles). I thought maybe it was getting stuck trying to read something it shouldn't, but lsof gives no clues.

Post by bitozoid » Wed, Dec 10, 2014, 11:30 AM UTC

etcet wrote: post #20

codezero wrote: post #2

Is there a quick and dirty script/one liner I can run to check my VPS right now?

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

  ionice -c 3 nice -n 19 grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' /

  ionice -c 3 nice -n 19 grep -ab -e 'TREX_PID=%u' -e 'Remote VS is empty !' /dev/sda