I'm trying to build a shell script which can automatically detect malware, backdoors and rootkits and I'm trying to research for it. I found some of the things like
find . -name “*.js” | xargs grep -l “eval(unescape”
find . -name “*.php” | xargs grep -l “eval(base64_decode”
But I dont find only these relevant to just find for .php and .js files and try to see if it consists of malware. Can anyone please help me to give a general idea that I can use for the script so that it can do the work of malware, backdoors and rootkits detection. More precisely to say how can one find these malwares, backdoors and rootkits on a ubuntu system. Thanks.
eval
withe=window["ev"+"al"];e
, for instance.