Re: Possible malware or compromised package..
 

Did you try to check the basic setup of the linux system, like users set up in /etc/shadow (is there shadow~ as a backup?) , groups and their permissions, cronjobs for specific users and system users?
Did you try to get chkrootkit from debian repo installed?

Re: Possible malware or compromised package..
 

Maemo ain't got no /etc/shadow :)

Re: Possible malware or compromised package..
 

can you log the dbus commands used to send sms? (if the program is using that interface)

Re: Possible malware or compromised package..
 

It's beginning to look like it might have been smscon. When I looked at smscon's logs, it stated something like, "WARNING: running in stolen mode". It would then send SMS messages to +0123456789 periodically. Also ever since removing smscon I haven't had any outgoing sms messages to egypt or romania (YET).

However, I will keep you updated because it might not be smscon.

Re: Possible malware or compromised package..
 

You may want to ask in the SMSCON thread and also read the smscon wiki page.
I have been using SMSCON with no issues for sometime.

The +0123456789 number you speak of in the logs maybe incorrect, IIRC some of the smscon.log personal data is stripped for security reasons.

Re: Possible malware or compromised package..
 

The +0123456789 is of course a dummy (not a valid country code), so there may be any number behind.
Keep us updated ...

Re: Possible malware or compromised package..
 

One solution that's worth trying, if you've got an old/other phone about is to get a PAYG sim and the minimum credit. Then use this PAYG number as the smscon "emergency contact". If you try the number of someone you know, warm him/her first: if you wake up at 3 o'clock in the night and check your phone for the time, he/she will get an sms!

smscon is not malware but, yes, it will send messages to the predefined number whenever the phone does something.

Re: Possible malware or compromised package..
 

No sms messages out to egypt or romania so far. :p

For the record I didn't configure smscon either, I just installed it.

I had it installed a year or two ago without having this problem. So I wonder if the maintainers/developers updated it?

Re: Possible malware or compromised package..
 

So far.. no more outgoing messages to Egypt or Romania.. I think it may have been smscon.

Re: Possible malware or compromised package..
 

Have you tried asking in the smscon thread?