Ghetto scanner to locate the Gen:Variant.Kazy.378723 virus/trojan using find and grep

find_kazy.sh

#!/bin/sh

# A hacky way to find a variant of the Kazy trojan virus.
# Maybe helpful if your Windows users had a Samba mount that got infected.
# See also:
# https://www.virustotal.com/en/file/25eaf33c12a669cd9ab6fc4f55fecc085704a4ee5f015ffb8bfdb1495a009f5a/analysis/1417196359/

find / -type f -iname '*.exe' -exec grep -R "lKTGM$S" {} \;
find / -type f -iname '*.exe' -exec grep -R "yUXWncK" {} \;

# To quarantine any *.exe files modified in the past 2 days:
# find / -type f -iname '*.exe' -mtime -2 -exec mv {} /home/bad_exe_pdf_files/ \;