5 ms·

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternati

• foxylad 12y ago
  Thanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.
  • tedunangst 12y ago
    Because you can't type a search string into the search box in explorer on windows?
    • gaadd33 12y ago
      The search box in explorer searches binaries these days? Honest question, I haven't used it in years. That seems like it would be pretty counterintuitive for users though. Someone tries to search for the string 'program' and it returns all binaries that have 'This program cannot be run in DOS mode' in them. (Which I think is pretty much all PE binaries)
      • tedunangst 12y ago
        I recall "search all files" looking inside pretty much everything, including exe and unknown file types. (it's been a while for me, too.)
        • gizmo686 12y ago
          I recall "search all files" only searching indexed folders, which by default leaves a lot of room for the virus to install itself somewhere that is not being search without even trying.
          • tedunangst 12y ago
            And then you click "search all folders (may be slow)".
    • nfoz 12y ago
      I appreciate what you're saying but you could have re-phrased without the negative sarcasm.
  • munin 12y ago
    they would just need to paste a command line to findstr: http://technet.microsoft.com/en-us/library/cc732459.aspx http://technet.microsoft.com/en-us/library/cc732459.aspx but don't let facts get in the way of your platform wars...
  • finid 12y ago
    That's why I won't use any OS that's not Unix-like. grep for this and that in this directory. Brilliant!
• danieltillett 12y ago
  Where does this come from?
  • etcet 12y ago
    I can't confirm that it works but I was going off this: > Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or 80.248.65.183, which are the addresses of known command and control channels hardcoded into the Linux trojan. Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS is empty !"
    • danieltillett 12y ago
      Thanks for this. Before I set off a search like this on my server I like to know why :)
• Bill_Dimm 12y ago
  This seems to get stuck for me after a few minutes (grep stops taking up CPU cycles). I thought maybe it was getting stuck trying to read something it shouldn't, but lsof gives no clues.
  • etcet 12y ago
    Perhaps try strace-ing the process? It should give you some clue as to what is going on.
    • Bill_Dimm 12y ago
      Ah, it's getting stuck on /var/spool/postfix/public/pickup Rerunning with "-D skip"
• bitozoid 12y ago
  I suggest with nice/ionice: ionice -c 3 nice -n 19 grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / You can also check the whole drive: ionice -c 3 nice -n 19 grep -ab -e 'TREX_PID=%u' -e 'Remote VS is empty !' /dev/sda