Hack inserts "the" into entry fields

Ask Fedora
1

I have used Fedora on the same machine since 2018. When I performed the latest update to:

Linux nyx 6.16.10-200.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Oct 2 19:23:55 UTC 2025 x86_64 GNU/Linux

I found that I had a hack that produced the word “the” in various varieties (“the”, “The”, etc.) wherever I could input from the keyboard (terminal, firefox, etc.). This hack appears to be a python3 program that self installs. When I delete the most recent python3 process, the hack goes away for a while, but then returns.

Has anyone else seen this? Is there a way to delete it permanently?

This is the first time I have ever had a problem with Fedora.

Ross

2

Can you see the command that the process is running?

For example if you do ps -f 5678 (replace 5678 with the ID of the process that you’re seeing) and you should get something like

UID          PID    PPID  C STIME TTY      STAT   TIME CMD
me          8198    8135  0 09:49 pts/2    S+     0:00 python evil_script.py
1 Like
3

Thanks for the suggestion! Here’s what I get:

UID PID PPID C STIME TTY STAT TIME CMD
ross 1192800 1192740 0 17:05 ? Sl 0:00 /usr/bin/python3 /usr/share/ibus-typing-booster/engine/main.

So I uninstalled the typing booster, which I don’t use, and we’ll see what happens. /usr/share/ibus-typing-booster is now gone.

Ross

1 Like