Hello, It looks like each of the machines with this problem so far has been rooted. A fairly detailed description of the rootkit installed can be found at http://www.reddit.com/r/netsec/comments/en650/details_of_the_root_kit_that_got_installed_on_my/ Regards, Arnout