anchor.diff:  Running this simple `curl` command:
   
   ----
  +curl -i http://myserver/favicon.iso | grep "Location:"
  +----
  +
  +Will result in the following output on an infected server:
  +
  +----
   $ curl -i http://myserver/favicon.iso | grep "Location:"
  -----
  -
  -Will result in the following output on an infected server:
  -
  -----
   Location: http://google.com/
   ----
   
  
positive.code: Linux/Ebury. A clean server will print
  
  ----
  ssh: illegal option -- G
  ----
  
  to `stderr` but an infected server will only print the usage. One can use the
  following command to determine if the server he is on is compromised:
  
  [source, bash]
  ----
  $ ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
  ----
  
  ==== Shared Memory Inspection
  
negative.code: `named` binary with:
  
  ----
  yara windigo-onimiki.yar /usr/sbin/named
  ----
  
  yields no output if one is not infected and would print a filename if one is.
  