up vote 0 down vote favorite
share [g+] share [fb]

I have recenrly found a file in my folder

called wunderbar_emporium

its details is here

What is that , how it came here and what should i check to make sure what arong has been done to system

link|improve this question
1  
Make a copy so you can analyse it later then nuke it from space and reinstall from a known good backup. This SF question and other related questions may be of help to you. – Iain♦ Oct 6 '10 at 7:10
feedback

1 Answer

up vote 3 down vote accepted

You could try installing rkhunter and/or chkrootkit. But: it might be too late, who knows which files already were modified?

I know it sucks, but:

  • Take the machine offline
  • Try to find out what happened
  • Reinstall machine and take countermeasures right at the start (file change detection programs like fcheck, aide etc)
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard