Ghost detector

gistfile1.txt

# Update glibc to your systems recommended patched version first
# As root, run this. If you're system is ok, you'll see nothing. Otherwise, this will tell you all infected processes. 

for proc in $(ls /proc); do if [ -e /proc/$proc/maps ];then if [ -n "`cat /proc/$proc/maps | grep -i libc- | grep -i deleted`" ];then echo $proc; echo "CMDLINE"; cat /proc/$proc/cmdline; echo -e "CMDLINE\n"; cat /proc/$proc/maps | grep -i libc- | grep -i deleted; fi fi done

for proc in $(ls /proc); do if [ -e /proc/$proc/maps ];then if [ -n "cat /proc/$proc/maps | grep -i $1 | grep -i deleted" ];then echo $proc; echo "CMDLINE"; cat /proc/$proc/cmdline; echo -e "CMDLINE\n"; cat /proc/$proc/maps | grep -i $1 | grep -i deleted; fi fi done