2
I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var
directory. Nothing I do lists the folder. ls -la
doesn't show the folder, but I can access the directory via cd silver
. Inside the folder there is a file called ~.b
- again I cannot see it or access it but I know it exists because my dmesg
log is full of segmentation faults caused by this file.
trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000] cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]
Trying to change attributes on the file or the folder seems to have no effect whatsoever
chattr -sia ~.b
chattr: No such file or directory while trying to stat ~.b
How do I get rid of this file and the directory?
1It might be an obvious one, but have you tried
rm -r silver
from within thevar
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask. – Matthew Williams – 2014-03-26T16:17:37.150Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks – Alex – 2014-03-26T16:21:33.073
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page https://www.digitalocean.com/community/articles/how-to-install-silverstripe-on-your-vps dont know if that would help out at all
– Richie086 – 2014-03-26T16:25:14.317It's just /var/silver – Alex – 2014-03-26T16:26:16.103