anchor.diff:  since the malware pays attention to that. This can be done with the following:
   
   ----
  -$ tcpdump -p
  +tcpdump -p
   ----
   
   Below is the list of domains generated by the DGA for each seed by DGA
  
positive.code: Running this simple `curl` command:
  
  ----
  $ curl -i http://myserver/favicon.iso | grep "Location:"
  ----
  
  Will result in the following output on an infected server:
  
  ----
  Location: http://google.com/
  ----
  
  
negative.code: Linux/Ebury. A clean server will print
  
  ----
  $ ssh -G
  ssh: illegal option -- G
  usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
             [-D [bind_address:]port] [-E log_file] [-e escape_char]
             [-F configfile] [-I pkcs11] [-i identity_file]
             [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
             [-O ctl_cmd] [-o option] [-p port]
             [-Q cipher | cipher-auth | mac | kex | key]
             [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
             [-w local_tun[:remote_tun]] [user@]hostname [command]
  ----
  
  to `stderr` but an infected server will only print the usage (note the missing
  `ssh: illegal option -- G`):
  
  ----
  $ ssh -G
  usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
             [-D [bind_address:]port] [-E log_file] [-e escape_char]
             [-F configfile] [-I pkcs11] [-i identity_file]
             [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
             [-O ctl_cmd] [-o option] [-p port]
             [-Q cipher | cipher-auth | mac | kex | key]
             [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
             [-w local_tun[:remote_tun]] [user@]hostname [command]
  ----
  
  
  One can use the following command to determine if the server he is on is compromised:
  
  [source, bash]
  ----
  ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
  ----
  
  ==== Shared Memory Inspection
  