7

I found a file in a directory named "." Not the "." indicating the directory but an actual file with content in it. This, as you can imagine is causing all sorts of problems. The problem is I can't figure out how to remove it. How would I remove a file named "." without deleting the entire current directory. Here is a listing just to show you:

drwx------  2 mysql    mysql     36864 Jun 28 14:11 .
drwxrwxr-x  5 mysql    mysql      4096 Jun 26 06:46 ..
-rw-r--r--  1 user1    users      2287 Jun 24 14:32 .
-rw-rw----  1 mysql    mysql        65 Jun 21 21:16 db.opt
-rw-r--r--  1 mysql    mysql         0 Jun 28 14:11 .hidden

You can see the directory (.) but you can also see the file owned by "user1" named "." of file size 2287. How would I remove this? (Running RHEL 4.6).

4
  • 13
    Last time I saw that, it was a rootkit, and I'd been hacked.
    – skaffman
    Jun 28, 2010 at 21:19
  • Wild guess, but rename and then delete?
    – Sonny
    Jun 28, 2010 at 21:20
  • @Sonny, he would end up renaming the directory, I think Jun 28, 2010 at 21:21
  • If/When it happens again, look inside the file or directory. Look for hints of a rootkit or a virus or anything. Don't just delete it.
    – user1686
    Jun 29, 2010 at 11:55

9 Answers 9

18

One way is to use the inode number

ls -i

Get the inode number of the bad file, pretend it is 42

find . -inum 42 -exec rm -i {} \;
14

Double-check that it doesn't have a space with ls -alQ:

drwxr-xr-x  2 adam adam 4096 2010-06-28 14:23 "."
-rw-r--r--  1 adam adam    0 2010-06-28 14:23 ". "
drwxr-xr-x 71 adam adam 4096 2010-06-28 14:23 ".."
1
  • Probably the best sure answer so far. Can probably be followed with "rm -i .\ " (without quotes, note escaped space). Jun 28, 2010 at 21:32
6

Try removing it by inode number

4
find -user user1 -print
find -user user1 -delete

My guess it's not really called '.'. There is probably a control character or similar. The above removes it based on the owner. The -print is a trial run to avoid surprises.

4

You could run rm with interactive and confirm only the files you want to delete example:

rm -i ./.
4

So it turns out it wasn't just a ".". There was a control character in the name (^M). As such, I just did a: rm -i ".^M" (key sequence control-V control-M) and it removed.

2

Are you sure it's called '.'. It doesn't have any spaces or anything, it's called '. '?

1

By default, rm does not remove directories, so why not just use

rm -i .
1
  • Yes, when it is just a file, you can directly use rm.
    – thegeek
    Jul 6, 2010 at 9:51
0

Try ls -il to get the inode number...though I not sure where you go from there. Perhaps bang up a quicky in c to get rid of it.

But if it is part of a rootkit, you need a clean install anyway...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.