I suggest with nice/ionice:

  ionice -c 3 nice -n 19 grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' /

You can also check the whole drive:

  ionice -c 3 nice -n 19 grep -ab -e 'TREX_PID=%u' -e 'Remote VS is empty !' /dev/sda

This seems to get stuck for me after a few minutes (grep stops taking up CPU cycles). I thought maybe it was getting stuck trying to read something it shouldn't, but lsof gives no clues.

Perhaps try strace-ing the process? It should give you some clue as to what is going on.

Ah, it's getting stuck on /var/spool/postfix/public/pickup

Rerunning with "-D skip"

Where does this come from?

I can't confirm that it works but I was going off this:

> Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or 80.248.65.183, which are the addresses of known command and control channels hardcoded into the Linux trojan. Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS is empty !"

Thanks for this. Before I set off a search like this on my server I like to know why :)

Thanks.

Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.

they would just need to paste a command line to findstr: http://technet.microsoft.com/en-us/library/cc732459.aspx

but don't let facts get in the way of your platform wars...

That's why I won't use any OS that's not Unix-like.

grep for this and that in this directory. Brilliant!

Because you can't type a search string into the search box in explorer on windows?

The search box in explorer searches binaries these days? Honest question, I haven't used it in years.

That seems like it would be pretty counterintuitive for users though. Someone tries to search for the string 'program' and it returns all binaries that have 'This program cannot be run in DOS mode' in them. (Which I think is pretty much all PE binaries)

I recall "search all files" looking inside pretty much everything, including exe and unknown file types. (it's been a while for me, too.)

I recall "search all files" only searching indexed folders, which by default leaves a lot of room for the virus to install itself somewhere that is not being search without even trying.

And then you click "search all folders (may be slow)".

I appreciate what you're saying but you could have re-phrased without the negative sarcasm.