[Bug 1641230] Re: package linux-image-4.4.0-43-generic 4.4.0-43.63 failed to install/upgrade: run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1 due to /usr/share/initramfs-tools/hooks/fsck failed with return 1

[Clayton M.]

I shut down the VM and used a live ISO to take a look at the filesystem.
You were correct - there is an /etc/ld.so.preload which points to
/lib/libgcwrap.so. There is also a /usr/lib/libgcwrap.so copy.

These files were marked as immutable and were not visible from the
booted system. I took a look at the cron configurations and found the
root user had an entry for "perfcc". Looking this up, perfcc/perfctl is
a crypto-miner malware.

Thanks for all your help in troubleshooting this. I hope it clarifies
for someone what may be afoot if they find libgcwrap present on their
system; there was nothing available on the popular search engines about
it.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to initramfs-tools in Ubuntu.
https://bugs.launchpad.net/bugs/1641230

Title:
  package linux-image-4.4.0-43-generic 4.4.0-43.63 failed to
  install/upgrade: run-parts: /etc/kernel/postinst.d/initramfs-tools
  exited with return code 1 due to /usr/share/initramfs-tools/hooks/fsck
  failed with return 1

Status in e2fsprogs package in Ubuntu:
  Confirmed
Status in initramfs-tools package in Ubuntu:
  Confirmed

Bug description:
  Do you want to continue? [Y/n] y
  (Reading database ... 254369 files and directories currently installed.)
  Removing linux-image-extra-4.4.0-43-generic (4.4.0-43.63) ...
  run-parts: executing /etc/kernel/postinst.d/apt-auto-removal 4.4.0-43-generic /boot/vmlinuz-4.4.0-43-generic
  run-parts: executing /etc/kernel/postinst.d/dkms 4.4.0-43-generic /boot/vmlinuz-4.4.0-43-generic
  Error! Your kernel headers for kernel 4.4.0-43-generic cannot be found.
  Please install the linux-headers-4.4.0-43-generic package,
  or use the --kernelsourcedir option to tell DKMS where it's located
  run-parts: executing /etc/kernel/postinst.d/initramfs-tools 4.4.0-43-generic /boot/vmlinuz-4.4.0-43-generic
  update-initramfs: Generating /boot/initrd.img-4.4.0-43-generic
  E: /usr/share/initramfs-tools/hooks/fsck failed with return 1.
  update-initramfs: failed for /boot/initrd.img-4.4.0-43-generic with 1.
  run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1
  dpkg: error processing package linux-image-extra-4.4.0-43-generic (--remove):
   subprocess installed post-removal script returned error exit status 1
  Removing linux-image-extra-4.4.0-47-generic (4.4.0-47.68) ...
  run-parts: executing /etc/kernel/postinst.d/apt-auto-removal 4.4.0-47-generic /boot/vmlinuz-4.4.0-47-generic
  run-parts: executing /etc/kernel/postinst.d/dkms 4.4.0-47-generic /boot/vmlinuz-4.4.0-47-generic
  run-parts: executing /etc/kernel/postinst.d/initramfs-tools 4.4.0-47-generic /boot/vmlinuz-4.4.0-47-generic
  update-initramfs: Generating /boot/initrd.img-4.4.0-47-generic
  E: /usr/share/initramfs-tools/hooks/fsck failed with return 1.
  update-initramfs: failed for /boot/initrd.img-4.4.0-47-generic with 1.
  run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1
  dpkg: error processing package linux-image-extra-4.4.0-47-generic (--remove):
   subprocess installed post-removal script returned error exit status 1
  Errors were encountered while processing:
   linux-image-extra-4.4.0-43-generic
   linux-image-extra-4.4.0-47-generic
  E: Sub-process /usr/bin/dpkg returned an error code (1)

  ProblemType: Package
  DistroRelease: Ubuntu 16.04
  Package: linux-image-4.4.0-43-generic 4.4.0-43.63
  ProcVersionSignature: Ubuntu 4.4.0-45.66-generic 4.4.21
  Uname: Linux 4.4.0-45-generic x86_64
  ApportVersion: 2.20.1-0ubuntu2.1
  Architecture: amd64
  AudioDevicesInUse:
   USER        PID ACCESS COMMAND
   /dev/snd/controlC0:  pezhman    1535 F.... pulseaudio
  Date: Fri Nov 11 21:03:09 2016
  ErrorMessage: run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1
  HibernationDevice: RESUME=UUID=e8c76af0-04d5-4831-a401-a0911630111c
  InstallationDate: Installed on 2016-08-27 (76 days ago)
  InstallationMedia: Ubuntu 16.04.1 LTS "Xenial Xerus" - Release amd64 (20160719)
  MachineType: ASUSTeK COMPUTER INC. S300CA
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-45-generic.efi.signed root=UUID=72d332d4-9180-442f-a032-8c1b612566ec ro quiet splash vt.handoff=7
  PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon.
  RelatedPackageVersions: grub-pc N/A
  SourcePackage: initramfs-tools
  Title: package linux-image-4.4.0-43-generic 4.4.0-43.63 failed to install/upgrade: run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1
  UpgradeStatus: No upgrade log present (probably fresh install)
  dmi.bios.date: 01/22/2013
  dmi.bios.vendor: American Megatrends Inc.
  dmi.bios.version: S300CA.302
  dmi.board.asset.tag: ATN12345678901234567
  dmi.board.name: S300CA
  dmi.board.vendor: ASUSTeK COMPUTER INC.
  dmi.board.version: 1.0
  dmi.chassis.asset.tag: No Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: ASUSTeK COMPUTER INC.
  dmi.chassis.version: 1.0
  dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrS300CA.302:bd01/22/2013:svnASUSTeKCOMPUTERINC.:pnS300CA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnS300CA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:
  dmi.product.name: S300CA
  dmi.product.version: 1.0
  dmi.sys.vendor: ASUSTeK COMPUTER INC.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/e2fsprogs/+bug/1641230/+subscriptions