How to manually detect and remove Linux.BackDoor.FakeFile.1 from linux system through the command line?

Question

According to Dr.web there is a new linux malware called Linux.BackDoor.FakeFile.1 , it can speared throught .pdf , gedit , open-office files .. , it can execute a multiples malicious functions using the user's right ( it doesn't require root privilege ) :

It then searches for a hidden file, whose name matches the file name of the Trojan, and replaces the executable file with it. For instance, if an ELF file of Linux.BackDoor.FakeFile.1 is named AnyName.pdf, the Trojan will search for a hidden file under the name .AnyName.pdf and then replace the original file with it by using the command mv.

Because the malware is recently (added on 2016-10-14) added to Dr.Web virus database, is that possible to verify linux systems by detecting and removing the backdoor through the command line ?

Answer 1

To detect the backdoor through the command line in user's home directory:

if [ -d "~/.gconf/apps/gnome-common/" ] ; then if [ `sha1sum ~/.gconf/apps/gnome-common/gnome-common | awk '{print $1}'` = 0138fc4d50c734e288388f7c8cbbea5e2ad08a8b ] ; then  echo "Linux.BackDoor.FakeFile.1 was found!"; else echo "You havn't virus"; fi else echo "You havn't virus"; fi

I think, this backdoor virus can't start automatically. User must run it from command line. Nautilus can't start it. But if you mount /home directory without exec privileges, you can live happy!