Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running Ubuntu Linux, and am having some major system issues (networking not working, etc), which I think could be based on this fundamental problem.

When I try execute a variety of basic commands (including ps, ls, ifconfig, locate), I receive the error 'no such file or directory'.

Here are some suggestions that I've found online, that I have tried without success:

  1. I did a 'whereis ps' and found the file in the /bin/, and have checked that '/bin' appears when I do 'echo $PATH'
  2. I did a filesystem check which showed my hard drive as being clean
  3. I tried doing a 'sudo chmod 777 ps' but was told that I dont have permission. I don't think permissions for these files would have changed though (and I can't check as I can't run the 'ls' command).

Any help would be highly appreciated.

share|improve this question

migrated from stackoverflow.com May 4 '11 at 10:38

This question came from our site for professional and enthusiast programmers.

    
/usr/bin/ldd /bin/ls –  Erik May 4 '11 at 9:35
    
To try any command (I use ls in my example) you can try to do a whereis ls and try to execute it using the full path, like /bin/ls. –  pconcepcion May 4 '11 at 9:37
1  
Maybe you are using some restricted shell? what is the output of echo $SHELL? –  Carlos Campderrós May 4 '11 at 10:27
    
What exactly is the output of echo $PATH –  Mark May 4 '11 at 11:19
    
cd into the directory and then prefix the command with an ./; i.e. cd /bin; ./ps. –  ultrasawblade May 4 '11 at 17:31
add comment

3 Answers

up vote 1 down vote accepted

To cut a long story short, it looks like I was rooted by SHV4 / SHV5 rootkit. I will soon be formatted and reinstalling my box.

For future reference though, I was able to fix the file permissions by changing the file attributes (chattr -ais <filename>) and then changed the file owner back to root. The files were infected anyway though.

Thanks to all for you help and suggestions

share|improve this answer
    
How did you discover that? Could you please add some details? –  Mr. Shickadance May 5 '11 at 13:35
3  
After I changed the attributes and ownership of the infected files, I still couldn't execute them and that's when I realized that something else was going on. I noticed that the owner of the infected files (before I changed it) was '122' so I started Googling, found articles on the SHV4 / SHV5 rootkit, and noticed that all the files it infects (ps, ls, netstat, ifconfig, find, top, etc) were the ones with that owner. –  Antony May 6 '11 at 7:38
    
Well, at least you identified it. Thanks for the follow-up. –  Mr. Shickadance May 6 '11 at 13:48
add comment

In many cases your default user (non-root) is restricted and, as such, basic commands require that you enter the absolute path to the command.

Alternatively, you can edit your own .bash_profile (or .profile, depending upon distro) file in your home directory and add:

PATH=/bin:/sbin:/otherdirectoryyouwanttoadd

Log out and log back in for the changes to take effect.

share|improve this answer
add comment

If sudo doesn't give you the ability to chmod, one suspects either a weird security setup (e.g. incorrectly applied ACLs) or that your system has been taken over by someone who doesn't want you fixing things and has locked your (and probably the legit root) accounts out of doing anything.

Try booting it off a LiveCD (like the Ubuntu install CD) made on another box.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.