<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Eradicating Malware — API Reference

## YARA Scanning

```bash
# Scan directory recursively
yara -r rules.yar /path/to/scan/

# Scan with multiple rule files
yara -r rules1.yar -r rules2.yar /path/

# Scan with timeout per file
yara -r rules.yar -a 30 /path/

# Output matching strings
yara -r -s rules.yar /path/

# Compile rules for faster scanning
yarac rules.yar compiled.yarc
yara -C compiled.yarc /path/
```

## LOKI Scanner

```bash
# Basic scan
python3 loki.py -p /path/to/scan/

# CSV output
python3 loki.py -p /path/ --csv -l results.csv

# Skip indicator download
python3 loki.py -p /path/ --noindicator

# Custom YARA rules directory
python3 loki.py -p /path/ --yara-rules /custom/rules/
```

## ClamAV

```bash
# Update signatures
freshclam

# Recursive scan, show infected only
clamscan -r --infected /path/

# Scan with logging
clamscan -r --infected --log=/evidence/clam.log /path/

# Remove infected files (CAUTION)
clamscan -r --infected --remove /path/
```

## Rootkit Detection

### chkrootkit

```bash
chkrootkit                    # Standard check
chkrootkit -q                 # Quiet mode (findings only)
chkrootkit -x                 # Expert mode
```

### rkhunter

```bash
rkhunter --update             # Update definitions
rkhunter --check              # Full check
rkhunter --check --report-warnings-only --skip-keypress
rkhunter --propupd            # Update file properties database
```

## Persistence Removal Commands

### Linux

```bash
# Crontab
crontab -r -u USERNAME                   # Remove user's crontab
rm /etc/cron.d/malicious_job             # Remove cron.d entry

# Systemd
systemctl stop SERVICE && systemctl disable SERVICE
rm /etc/systemd/system/SERVICE.service
systemctl daemon-reload

# SSH keys
sed -i '/FINGERPRINT/d' ~/.ssh/authorized_keys

# Users
userdel -r BACKDOOR_USER

# Kernel modules
rmmod MALICIOUS_MODULE
echo "blacklist MALICIOUS_MODULE" >> /etc/modprobe.d/blacklist.conf
```

### Windows

```powershell
# Registry Run keys
Remove-ItemProperty -Path "HKLM:\...\Run" -Name "EntryName"

# Scheduled tasks
Unregister-ScheduledTask -TaskName "TaskName" -Confirm:$false

# Services
Stop-Service -Name "SvcName" -Force; sc.exe delete "SvcName"

# WMI subscriptions
Get-WmiObject -Namespace root\subscription -Class __EventFilter | Remove-WmiObject
Get-WmiObject -Namespace root\subscription -Class __EventConsumer | Remove-WmiObject
Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding | Remove-WmiObject
```

## Common Patterns

### Eradication Checklist

```
1. Enumerate all persistence (registry, tasks, services, cron, systemd)
2. Identify all malware files (YARA, LOKI, AV scan)
3. Remove persistence mechanisms first
4. Delete malware binaries
5. Remove backdoor accounts
6. Rotate all credentials
7. Re-scan to verify clean state
8. Update integrity baselines
```

### Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `rules_path` | YARA rules file or directory | `/rules/malware.yar` |
| `scan_path` | Target path to scan | `/tmp` |
| `timeout` | Per-file scan timeout (seconds) | `30` |
| `recursive` | Scan subdirectories | `true` |
