Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have recenrly found a file in my folder

called wunderbar_emporium

its details is here

What is that , how it came here and what should i check to make sure what arong has been done to system

share|improve this question
Make a copy so you can analyse it later then nuke it from space and reinstall from a known good backup. This SF question and other related questions may be of help to you. – Iain Oct 6 '10 at 7:10
up vote 3 down vote accepted

You could try installing rkhunter and/or chkrootkit. But: it might be too late, who knows which files already were modified?

I know it sucks, but:

  • Take the machine offline
  • Try to find out what happened
  • Reinstall machine and take countermeasures right at the start (file change detection programs like fcheck, aide etc)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.