anchor.diff:  Linux/Ebury. A clean server will print
   
   ----
  +$ ssh -G
   ssh: illegal option -- G
  -----
  -
  -to `stderr` but an infected server will only print the usage. One can use the
  -following command to determine if the server he is on is compromised:
  +usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
  +           [-D [bind_address:]port] [-E log_file] [-e escape_char]
  +           [-F configfile] [-I pkcs11] [-i identity_file]
  +           [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
  +           [-O ctl_cmd] [-o option] [-p port]
  +           [-Q cipher | cipher-auth | mac | kex | key]
  +           [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
  +           [-w local_tun[:remote_tun]] [user@]hostname [command]
  +----
  +
  +to `stderr` but an infected server will only print the usage (note the missing
  +`ssh: illegal option -- G`):
  +
  +----
  +$ ssh -G
  +usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
  +           [-D [bind_address:]port] [-E log_file] [-e escape_char]
  +           [-F configfile] [-I pkcs11] [-i identity_file]
  +           [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
  +           [-O ctl_cmd] [-o option] [-p port]
  +           [-Q cipher | cipher-auth | mac | kex | key]
  +           [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
  +           [-w local_tun[:remote_tun]] [user@]hostname [command]
  +----
  +
  +
  +One can use the following command to determine if the server he is on is compromised:
   
   [source, bash]
   ----
  -$ ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
  +ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
   ----
   
   ==== Shared Memory Inspection
  
positive.code: `named` binary with:
  
  ----
  $ yara windigo-onimiki.yar /usr/sbin/named
  ----
  
  yields no output if one is not infected and would print a filename if one is.
  
negative.code: since the malware pays attention to that. This can be done with the following:
  
  ----
  tcpdump -p
  ----
  
  Below is the list of domains generated by the DGA for each seed by DGA
  