User: padyer

Re:Just off the top of my head

On: How Do You Evaluate a Data Center?

+1

Re:mkdir 1

On: Mystery Malware Affecting Linux/Apache Web Servers

That regex is b0rken. It matches any file of at LEAST 5 chars that ends in .js. The story at cPanel says that it is exactly 5 random chars and then the .js. Should be changed to

tcpdump -nAs 2048 src port 80 | grep "/[a-zA-Z]\{5\}\.js'"

Note the / at the beginning of the grep regex.