Cannot delete folder or files inside












2















I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var directory. Nothing I do lists the folder. ls -la doesn't show the folder, but I can access the directory via cd silver. Inside the folder there is a file called ~.b - again I cannot see it or access it but I know it exists because my dmesg log is full of segmentation faults caused by this file.



trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]


Trying to change attributes on the file or the folder seems to have no effect whatsoever



chattr -sia ~.b




chattr: No such file or directory while trying to stat ~.b




How do I get rid of this file and the directory?










share|improve this question




















  • 1





    It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.

    – Matthew Williams
    Mar 26 '14 at 16:17











  • Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks

    – Alex
    Mar 26 '14 at 16:21











  • Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all

    – Richie086
    Mar 26 '14 at 16:25













  • It's just /var/silver

    – Alex
    Mar 26 '14 at 16:26
















2















I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var directory. Nothing I do lists the folder. ls -la doesn't show the folder, but I can access the directory via cd silver. Inside the folder there is a file called ~.b - again I cannot see it or access it but I know it exists because my dmesg log is full of segmentation faults caused by this file.



trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]


Trying to change attributes on the file or the folder seems to have no effect whatsoever



chattr -sia ~.b




chattr: No such file or directory while trying to stat ~.b




How do I get rid of this file and the directory?










share|improve this question




















  • 1





    It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.

    – Matthew Williams
    Mar 26 '14 at 16:17











  • Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks

    – Alex
    Mar 26 '14 at 16:21











  • Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all

    – Richie086
    Mar 26 '14 at 16:25













  • It's just /var/silver

    – Alex
    Mar 26 '14 at 16:26














2












2








2








I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var directory. Nothing I do lists the folder. ls -la doesn't show the folder, but I can access the directory via cd silver. Inside the folder there is a file called ~.b - again I cannot see it or access it but I know it exists because my dmesg log is full of segmentation faults caused by this file.



trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]


Trying to change attributes on the file or the folder seems to have no effect whatsoever



chattr -sia ~.b




chattr: No such file or directory while trying to stat ~.b




How do I get rid of this file and the directory?










share|improve this question
















I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var directory. Nothing I do lists the folder. ls -la doesn't show the folder, but I can access the directory via cd silver. Inside the folder there is a file called ~.b - again I cannot see it or access it but I know it exists because my dmesg log is full of segmentation faults caused by this file.



trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]


Trying to change attributes on the file or the folder seems to have no effect whatsoever



chattr -sia ~.b




chattr: No such file or directory while trying to stat ~.b




How do I get rid of this file and the directory?







linux malware-removal rootkit






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Apr 9 '17 at 9:08









user 99572 is fine

2,84832539




2,84832539










asked Mar 26 '14 at 16:03









AlexAlex

413




413








  • 1





    It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.

    – Matthew Williams
    Mar 26 '14 at 16:17











  • Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks

    – Alex
    Mar 26 '14 at 16:21











  • Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all

    – Richie086
    Mar 26 '14 at 16:25













  • It's just /var/silver

    – Alex
    Mar 26 '14 at 16:26














  • 1





    It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.

    – Matthew Williams
    Mar 26 '14 at 16:17











  • Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks

    – Alex
    Mar 26 '14 at 16:21











  • Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all

    – Richie086
    Mar 26 '14 at 16:25













  • It's just /var/silver

    – Alex
    Mar 26 '14 at 16:26








1




1





It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.

– Matthew Williams
Mar 26 '14 at 16:17





It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask.

– Matthew Williams
Mar 26 '14 at 16:17













Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks

– Alex
Mar 26 '14 at 16:21





Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks

– Alex
Mar 26 '14 at 16:21













Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all

– Richie086
Mar 26 '14 at 16:25







Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all

– Richie086
Mar 26 '14 at 16:25















It's just /var/silver

– Alex
Mar 26 '14 at 16:26





It's just /var/silver

– Alex
Mar 26 '14 at 16:26










2 Answers
2






active

oldest

votes


















1














For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.



Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.



The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.



Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.



If the fsck fails to finish, it would indicate a bad drive.



Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.



If it's gone, you most likely had a filesystem issue.



If it's still there, you should be able to remove it with the



rm -f ~.b 


command.



The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.






share|improve this answer
























  • Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

    – Alex
    Mar 27 '14 at 9:44



















1














Managed to finally get it deleted.



LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"



And then did a chattr -sia on the folder and deleted it.






share|improve this answer























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "3"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f733893%2fcannot-delete-folder-or-files-inside%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    2 Answers
    2






    active

    oldest

    votes








    2 Answers
    2






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    1














    For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.



    Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.



    The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.



    Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.



    If the fsck fails to finish, it would indicate a bad drive.



    Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.



    If it's gone, you most likely had a filesystem issue.



    If it's still there, you should be able to remove it with the



    rm -f ~.b 


    command.



    The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.






    share|improve this answer
























    • Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

      – Alex
      Mar 27 '14 at 9:44
















    1














    For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.



    Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.



    The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.



    Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.



    If the fsck fails to finish, it would indicate a bad drive.



    Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.



    If it's gone, you most likely had a filesystem issue.



    If it's still there, you should be able to remove it with the



    rm -f ~.b 


    command.



    The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.






    share|improve this answer
























    • Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

      – Alex
      Mar 27 '14 at 9:44














    1












    1








    1







    For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.



    Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.



    The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.



    Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.



    If the fsck fails to finish, it would indicate a bad drive.



    Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.



    If it's gone, you most likely had a filesystem issue.



    If it's still there, you should be able to remove it with the



    rm -f ~.b 


    command.



    The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.






    share|improve this answer













    For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.



    Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.



    The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.



    Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.



    If the fsck fails to finish, it would indicate a bad drive.



    Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.



    If it's gone, you most likely had a filesystem issue.



    If it's still there, you should be able to remove it with the



    rm -f ~.b 


    command.



    The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Mar 26 '14 at 16:41









    Dan LDan L

    1615




    1615













    • Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

      – Alex
      Mar 27 '14 at 9:44



















    • Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

      – Alex
      Mar 27 '14 at 9:44

















    Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

    – Alex
    Mar 27 '14 at 9:44





    Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.

    – Alex
    Mar 27 '14 at 9:44













    1














    Managed to finally get it deleted.



    LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"



    And then did a chattr -sia on the folder and deleted it.






    share|improve this answer




























      1














      Managed to finally get it deleted.



      LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"



      And then did a chattr -sia on the folder and deleted it.






      share|improve this answer


























        1












        1








        1







        Managed to finally get it deleted.



        LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"



        And then did a chattr -sia on the folder and deleted it.






        share|improve this answer













        Managed to finally get it deleted.



        LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"



        And then did a chattr -sia on the folder and deleted it.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Mar 28 '14 at 10:39









        AlexAlex

        413




        413






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Super User!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f733893%2fcannot-delete-folder-or-files-inside%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            "Incorrect syntax near the keyword 'ON'. (on update cascade, on delete cascade,)

            Alcedinidae

            Origin of the phrase “under your belt”?