Some sort of malware

Question

Gmail account had been compromised.
Thought it was from logging on to another computer that was infected.
Changed password on my netbook with Arch Linux here.
A day later, more suspicious activity, from THREE DIFFERENT COUNTRIES.
Therefore there must be some form of malware on my netbook.
I've used Clyde to install packages from AUR, so I assume that's where the problem stems from.
How do I go about weeding out the malware?
I'd rather not have to go through the trouble of reinstalling Arch (USB drive is iffy now, constantly disconnects itself), but if I absolutely have to, I will.
Sad, sad days.

Answer 1

Check extensions in firefox (/ other browser), maybe there is something suspicious. Also, with this script, you can check if any files on your system are different from ones in repo:
#!/bin/bash
TEMP=$(mktemp -d)
cd $TEMP
echo ' => Comparing fs with pacman db...'
/usr/bin/pacman -Ql | cut -d ' ' -f 2- > db.txt && sort -u db.txt > db.sorted.txt &
sudo find / -xdev -type f -o -type l > fs.txt && sort -u fs.txt > fs.sorted.txt &
wait
comm -2 -3 {fs,db}.sorted.txt > non-db.txt &
comm -1 -3 {fs,db}.sorted.txt > missing.txt &
wait
rm {fs,db}{,.sorted}.txt
echo ' => Checking installed packages...'
pacman -Qq > pacman.qq.txt && sort -u pacman.qq.txt > pacman.qq.sorted.txt &
pacman -Slq > pacman.slq.txt && sort -u pacman.slq.txt > pacman.slq.sorted.txt &
wait
comm -12 pacman.{qq,slq}.sorted.txt > packages.txt
rm pacman.{qq,slq}{,.sorted}.txt
rm -f md5sums.txt && touch md5sums.txt
for package in $(cat packages.txt); do
echo -n " -> Checking $package..."
sudo powerpill -Sw --noconfirm $package
rm -rf pkgtmp && mkdir pkgtmp
bsdtar -x -C pkgtmp -f /var/cache/pacman/pkg/$(pacman -Sp $package | sed 's@.*/@@g')
cd pkgtmp
find -type f ! -name .PKGINFO ! -name .INSTALL ! -name .CHANGELOG -exec md5sum {} \; >> ../md5sums.txt
cd $TEMP
tput el1; tput cr;
done
echo " => Checking filesystem..."
cd /
md5sum --check --quiet $TEMP/md5sums.txt > $TEMP/diffrent.txt
echo " => Done. Check non-db.txt, missing.txt and different.txt from $TEMP"
It's very dirty (hacked from few other scripts), but it get jobs done. You will need change it to match your system. It check every file in filesystem, if it's from repo then it compares md5 sums, if it's not from repo then it should inform you about it (so don't worry about config files in /etc/, they should be different from stock ones).
And maybe run this from livecd, because if your system was hacked / compromised, then you can't even trust your /bin (eg. /usr/bin/md5sum may be changed to return original checksum on modified binaries).
Is there a way to print this output? The currently running applications I mean.
ps aux
Check "lsof -i -P -n", "last" and /var/log/* too.
Last edited by hiciu (2010-09-05 03:09:31)