Cannot delete folder or files inside
I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var
directory. Nothing I do lists the folder. ls -la
doesn't show the folder, but I can access the directory via cd silver
. Inside the folder there is a file called ~.b
- again I cannot see it or access it but I know it exists because my dmesg
log is full of segmentation faults caused by this file.
trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]
Trying to change attributes on the file or the folder seems to have no effect whatsoever
chattr -sia ~.b
chattr: No such file or directory while trying to stat ~.b
How do I get rid of this file and the directory?
linux malware-removal rootkit
add a comment |
I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var
directory. Nothing I do lists the folder. ls -la
doesn't show the folder, but I can access the directory via cd silver
. Inside the folder there is a file called ~.b
- again I cannot see it or access it but I know it exists because my dmesg
log is full of segmentation faults caused by this file.
trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]
Trying to change attributes on the file or the folder seems to have no effect whatsoever
chattr -sia ~.b
chattr: No such file or directory while trying to stat ~.b
How do I get rid of this file and the directory?
linux malware-removal rootkit
1
It might be an obvious one, but have you triedrm -r silver
from within thevar
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.
– Matthew Williams
Mar 26 '14 at 16:17
Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
– Alex
Mar 26 '14 at 16:21
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
– Richie086
Mar 26 '14 at 16:25
It's just /var/silver
– Alex
Mar 26 '14 at 16:26
add a comment |
I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var
directory. Nothing I do lists the folder. ls -la
doesn't show the folder, but I can access the directory via cd silver
. Inside the folder there is a file called ~.b
- again I cannot see it or access it but I know it exists because my dmesg
log is full of segmentation faults caused by this file.
trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]
Trying to change attributes on the file or the folder seems to have no effect whatsoever
chattr -sia ~.b
chattr: No such file or directory while trying to stat ~.b
How do I get rid of this file and the directory?
linux malware-removal rootkit
I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var
directory. Nothing I do lists the folder. ls -la
doesn't show the folder, but I can access the directory via cd silver
. Inside the folder there is a file called ~.b
- again I cannot see it or access it but I know it exists because my dmesg
log is full of segmentation faults caused by this file.
trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]
Trying to change attributes on the file or the folder seems to have no effect whatsoever
chattr -sia ~.b
chattr: No such file or directory while trying to stat ~.b
How do I get rid of this file and the directory?
linux malware-removal rootkit
linux malware-removal rootkit
edited Apr 9 '17 at 9:08
user 99572 is fine
2,84832539
2,84832539
asked Mar 26 '14 at 16:03
AlexAlex
413
413
1
It might be an obvious one, but have you triedrm -r silver
from within thevar
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.
– Matthew Williams
Mar 26 '14 at 16:17
Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
– Alex
Mar 26 '14 at 16:21
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
– Richie086
Mar 26 '14 at 16:25
It's just /var/silver
– Alex
Mar 26 '14 at 16:26
add a comment |
1
It might be an obvious one, but have you triedrm -r silver
from within thevar
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.
– Matthew Williams
Mar 26 '14 at 16:17
Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
– Alex
Mar 26 '14 at 16:21
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
– Richie086
Mar 26 '14 at 16:25
It's just /var/silver
– Alex
Mar 26 '14 at 16:26
1
1
It might be an obvious one, but have you tried
rm -r silver
from within the var
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.– Matthew Williams
Mar 26 '14 at 16:17
It might be an obvious one, but have you tried
rm -r silver
from within the var
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.– Matthew Williams
Mar 26 '14 at 16:17
Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
– Alex
Mar 26 '14 at 16:21
Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
– Alex
Mar 26 '14 at 16:21
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
– Richie086
Mar 26 '14 at 16:25
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
– Richie086
Mar 26 '14 at 16:25
It's just /var/silver
– Alex
Mar 26 '14 at 16:26
It's just /var/silver
– Alex
Mar 26 '14 at 16:26
add a comment |
2 Answers
2
active
oldest
votes
For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.
Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.
The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.
Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.
If the fsck fails to finish, it would indicate a bad drive.
Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.
If it's gone, you most likely had a filesystem issue.
If it's still there, you should be able to remove it with the
rm -f ~.b
command.
The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
add a comment |
Managed to finally get it deleted.
LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"
And then did a chattr -sia on the folder and deleted it.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f733893%2fcannot-delete-folder-or-files-inside%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.
Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.
The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.
Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.
If the fsck fails to finish, it would indicate a bad drive.
Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.
If it's gone, you most likely had a filesystem issue.
If it's still there, you should be able to remove it with the
rm -f ~.b
command.
The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
add a comment |
For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.
Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.
The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.
Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.
If the fsck fails to finish, it would indicate a bad drive.
Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.
If it's gone, you most likely had a filesystem issue.
If it's still there, you should be able to remove it with the
rm -f ~.b
command.
The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
add a comment |
For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.
Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.
The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.
Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.
If the fsck fails to finish, it would indicate a bad drive.
Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.
If it's gone, you most likely had a filesystem issue.
If it's still there, you should be able to remove it with the
rm -f ~.b
command.
The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.
For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.
Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.
The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.
Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.
If the fsck fails to finish, it would indicate a bad drive.
Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.
If it's gone, you most likely had a filesystem issue.
If it's still there, you should be able to remove it with the
rm -f ~.b
command.
The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.
answered Mar 26 '14 at 16:41
Dan LDan L
1615
1615
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
add a comment |
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
– Alex
Mar 27 '14 at 9:44
add a comment |
Managed to finally get it deleted.
LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"
And then did a chattr -sia on the folder and deleted it.
add a comment |
Managed to finally get it deleted.
LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"
And then did a chattr -sia on the folder and deleted it.
add a comment |
Managed to finally get it deleted.
LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"
And then did a chattr -sia on the folder and deleted it.
Managed to finally get it deleted.
LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"
And then did a chattr -sia on the folder and deleted it.
answered Mar 28 '14 at 10:39
AlexAlex
413
413
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f733893%2fcannot-delete-folder-or-files-inside%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
It might be an obvious one, but have you tried
rm -r silver
from within thevar
directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.– Matthew Williams
Mar 26 '14 at 16:17
Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
– Alex
Mar 26 '14 at 16:21
Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
– Richie086
Mar 26 '14 at 16:25
It's just /var/silver
– Alex
Mar 26 '14 at 16:26