Check for Drovorub Malware
Quoted reply
(5 lines)
touch testfile
echo “ASDFZXCV:hf:testfile” > /dev/zero
If the testfile disappears… you are infected
touch testfile
<span class="gmail-nb">echo</span> “ASDFZXCV:hf:testfile” > /dev/zero
|
If the testfile disappears… you are infected
Check for unsigned kernel modules
<span class="gmail-k">for</span> mod in <span class="gmail-k">$(</span>lsmod <span class="gmail-p">|</span> tail -n +2 <span class="gmail-p">|</span> cut -d<span class="gmail-s1">' '</span> -f1<span class="gmail-k">)</span><span class="gmail-p">;</span> <span class="gmail-k">do</span> modinfo <span class="gmail-si">${</span><span class="gmail-nv">mod</span><span class="gmail-si">}</span> <span class="gmail-p">|</span> grep -q <span class="gmail-s2">"signature"</span> <span class="gmail-o">||</span> <span class="gmail-nb">echo</span> <span class="gmail-s2">"no signature for module: </span><span class="gmail-si">${</span><span class="gmail-nv">mod</span><span class="gmail-si">}</span><span class="gmail-s2">"</span> <span class="gmail-p">;</span> <span class="gmail-k">done</span>
|
If you see vbox or nvidia modules, these are for VirtualBox and NVidia Drivers respectively
https://www.youtube.com/watch?v=V-GYYrsNNSM
https://christitus.com/secure-linux/
