Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have recenrly found a file in my folder

called wunderbar_emporium

its details is here

What is that , how it came here and what should i check to make sure what arong has been done to system

share|improve this question
1  
Make a copy so you can analyse it later then nuke it from space and reinstall from a known good backup. This SF question and other related questions may be of help to you. –  Iain Oct 6 '10 at 7:10

1 Answer 1

up vote 3 down vote accepted

You could try installing rkhunter and/or chkrootkit. But: it might be too late, who knows which files already were modified?

I know it sucks, but:

  • Take the machine offline
  • Try to find out what happened
  • Reinstall machine and take countermeasures right at the start (file change detection programs like fcheck, aide etc)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.