[Shank]

Check if /tmp/update exists. If it does, you’re infected.

[seenukarthi]

I think the malware tries to delete this file. So, it won't be a reliable method to identify whether you were infected.