2

I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged in as root on the server. The folder is called silver and its inside the var directory. Nothing I do lists the folder. ls -la doesn't show the folder, but I can access the directory via cd silver. Inside the folder there is a file called ~.b - again I cannot see it or access it but I know it exists because my dmesg log is full of segmentation faults caused by this file.

trivial-rewrite[24096]: segfault at 2 ip 00007f65c5457e65 sp 00007fff596e5360 error 4 in ~.b[7f65c5455000+6000]
cleanup[24097]: segfault at 2 ip 00007fd614f29e65 sp 00007ffffe7ad2c0 error 4 in ~.b[7fd614f27000+6000]

Trying to change attributes on the file or the folder seems to have no effect whatsoever

chattr -sia ~.b

chattr: No such file or directory while trying to stat ~.b

How do I get rid of this file and the directory?

4
  • 1
    It might be an obvious one, but have you tried rm -r silver from within the var directory? You said you tried to delete it, but this could be through GUI, so thought I would ask. Mar 26, 2014 at 16:17
  • Hello Matt, I should have mentioned that I only have access to the service using SSH. But yes did try that - didn't work. Thanks
    – Alex
    Mar 26, 2014 at 16:21
  • Just wondering, is the full path to the silver directory /var/www/silver? or just /var/silver? I googled /var/silver and came across the following page digitalocean.com/community/articles/… dont know if that would help out at all
    – Richie086
    Mar 26, 2014 at 16:25
  • It's just /var/silver
    – Alex
    Mar 26, 2014 at 16:26

2 Answers 2

1

For the attempted fix, it will require a reboot and local access to the server. As you haven't given info about the filesystem or underlying drives/raid/lvm, these are generic instructions.

Most likely issue is just a bad drive with an unwriteable block but other situations are possible. The first is that you have a file system corruption and that link is unchangeable. Another is that you do have a rootkit and the rootkit is blocking access to the file, as you suggest.

The easiest way to address all of these is to reboot the server with a standalone rescue disk. I'd recommend the apply named systemrescueCD, but your original OS install disk should also have a rescue mode. You should obtain the image and burn it to a disk on another system. The reboot from clean media will potentially remove any rootkits or filesystem locks.

Once booted, run the appropriate fsck check for the filesystem type to attempt to address any errors. If you are running a raid or lvm, you'll need to recreate that manually before running the fsck. Do not mount the filesystem at this point before the fsck.

If the fsck fails to finish, it would indicate a bad drive.

Assuming the fsck finishes successfully (even if it had to correct some errors), you will need to mount the filesystem manually and check to see if the suspect file is still there.

If it's gone, you most likely had a filesystem issue.

If it's still there, you should be able to remove it with the

rm -f ~.b 

command.

The thing is, if the results of these efforts seem to indicate a rootikit (not a bad drive or filesystem), you'll want to format the drive and do a full restore of the OS anyways, as you really can't be sure you've cleaned it all out.

1
  • Dan : Well definitely no issues on the file system. Fsck reports the file system is clean. We booted up with the SystemRescue LiveCD - nothing is wrong with the filesystem. However we still cannot see /var/silver folder and nor are we able to delete the offending file, even when we boot from SystemRescueCD - I think reformatting and rebuilding the machine probably might be our only way out at this point. though it annoys the heck out of me as to why I simply cannot delete a folder - I mean having to reinstall an entire OS and application server just because I cannot delete a file sounds silly.
    – Alex
    Mar 27, 2014 at 9:44
1

Managed to finally get it deleted.

LD_PRELOAD="/var/silver/~.a" chattr -sia "/etc/ld.so.preload";LD_PRELOAD="/var/silver/~.a" rm "/etc/ld.so.preload"

And then did a chattr -sia on the folder and deleted it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .