<div dir="ltr"><div><div><div>Well, I am basically a novice who has learned much recently, (many of my describing terms may not be accurate, steep learning curve) but I have a google drive page describing the infection:<br>
<br>
</div>I first noticed a self replicating infection on a Knoppix CD-ROM 7 months ago. Months Later I noticed the same symptoms when I booted UBCD Parted Magic.<br><br></div>I know the hackers step up infection (they install zypper in OpenSuse for example.) This is part rootkit similar to "flame" and part social engineered artificial internet environment.<br>
<br><br></div>Note: click on malware symptoms for overview, also, the "beefpages" is now a broken link.<br><div><br><a href="https://drive.google.com/folderview?id=0B7Mx1oILAt8WRnpqa1l1bU1tMWc&usp=sharing" target="_blank">https://drive.google.com/folderview?id=0B7Mx1oILAt8WRnpqa1l1bU1tMWc&usp=sharing</a><br>
<br><br></div><div>Please excuse the brevity, library closing in minutes<br><br></div><div>Thanks for your prompt response and help<br><br></div><div>-Steve<br></div><div><br>
<div><div><div><br> <br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Nov 15, 2013 at 7:41 PM, Jasper St. Pierre <span dir="ltr"><<a href="mailto:jstpierre@mecheye.net" target="_blank">jstpierre@mecheye.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div>On Fri, Nov 15, 2013 at 6:10 PM, Stephen Reichow <span dir="ltr"><<a href="mailto:stephen.reichow@gmail.com" target="_blank">stephen.reichow@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>Hello, I have found some components of <a href="http://freedesktop.org" target="_blank">freedesktop.org</a> are being abused in conjunction with a rootkit infection.<br>
<br><a href="http://www.freedesktop.org/wiki/Software/PolicyKit/PluggableArchitecture/" target="_blank">http://www.freedesktop.org/wiki/Software/PolicyKit/PluggableArchitecture/</a><br>
<br></div>The pluggable architecture is the SSH component of a malware rootkit on my computer, giving remote attackers access.<br><br></div><div>Any help would be appreciated.<br></div></div></blockquote><div><br></div></div>
</div><div>
I don't think PolicyKit is at fault, here. If you have permissions to write to /usr/lib, where the plugins are stored, you can do a lot of damage by installing a replacement glibc, for instance.<br><br></div><div>Do you know how the infection started?<br>
</div><div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div></div><div>Thank You -Steve<br></div><div>
<br></div><br></div>
<br>_______________________________________________<br>
xdg mailing list<br>
<a href="mailto:xdg@lists.freedesktop.org" target="_blank">xdg@lists.freedesktop.org</a><br>
<a href="http://lists.freedesktop.org/mailman/listinfo/xdg" target="_blank">http://lists.freedesktop.org/mailman/listinfo/xdg</a><br>
<br></blockquote></div></div><span><font color="#888888"><br><br clear="all"><br>-- <br> Jasper<br>
</font></span></div></div>
</blockquote></div><br></div></div></div>