Diff for "detect_malware"

major way to detect malware first top and see if any process use lot of cpu

1. cat /proc/pid/pwd to see which dir it run in and see any suspicious files in it and delete it

rm files <-- if no permission, then chmod, if still no permission then lsattr
lsattr files <-- check if have is immutable if yes remove it
chattr -i -a files <-- remove immutable flags. then rm again
rm files

• 2,load up backup and compare files different.

mkdir /mnt/backfil/ <-- make a dir to mount at
ls /dev/vd* <-- list the back up device
mount /dev/vdc1 /mnt/backfil <-- mount the backup device to file
cd  / <-- goes to root dir
rsync -avn /mnt/backfil/ ./ | less <--compare file differents, n is important testing mode.

• 3,compare the file different and find any suspisious file , e.g, file in etc/, some service executables, copy the file from backup.
  • example /etc/ssh/ has been changed , rsynd it from mounts

cd /etc/ssh/
rsync -av /mnt/backfil/etc/ssh/ ./