anchor.diff:  `named` binary with:
   
   ----
  -$ yara windigo-onimiki.yar /usr/sbin/named
  +yara windigo-onimiki.yar /usr/sbin/named
   ----
   
   yields no output if one is not infected and would print a filename if one is.
  
positive.code: since the malware pays attention to that. This can be done with the following:
  
  ----
  $ tcpdump -p
  ----
  
  Below is the list of domains generated by the DGA for each seed by DGA
  
negative.code: Running this simple `curl` command:
  
  ----
  curl -i http://myserver/favicon.iso | grep "Location:"
  ----
  
  Will result in the following output on an infected server:
  
  ----
  $ curl -i http://myserver/favicon.iso | grep "Location:"
  Location: http://google.com/
  ----
  
  