Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There are one file uploaded by some exploit. I am not able to delete that file even from root login. What may be the issue how i can delete that, i already check for immutable and stick bit status. Any suggestion really helpful for me

Thanks

share|improve this question
    
What filesystem is this on? What does lsattr filename and ls -lZ filename say? What about the directory the file is in (add -d)? What error are you getting when you try to remove the file? –  DerfK Mar 29 '11 at 0:13
    
Check that the file doesn't have trailing whitespace. But I'm curious, what "exploit" is this, and what file is it? –  Keith Mar 29 '11 at 0:23
    
Also, how did you conclude that the file was created maliciously. Update with all of this information. –  Scott Pack Mar 29 '11 at 0:49
1  
Side point, but if your system has been exploited you should be doing a complete reinstall and restore your data from backup. Cleaning the system is tricky as it can be very difficult to be sure you've got rid of everything. –  Daniel Lawson Mar 29 '11 at 1:08
    
Verify that you have a backup, format, and reinstall. -- Reinstall after a Root Compromise –  Zoredache Mar 29 '11 at 3:00
add comment

2 Answers 2

up vote 2 down vote accepted

Reformat the machine and restore from backups.

Don't waste your time trying to remove one specific file. Think of it this way, if they were able to create this one file, how can you ever be certain they didn't make more permanent changes (think rootkit)?

share|improve this answer
add comment

What kind of error you are getting while trying to delete the file?

Paste here the name of that file.

I have seen many hack scripts in /tmp with name starting with hyphen(-). If this is your case, you can delete it by

root@local [~]# rm ./-
rm: remove regular empty file `./-'? y
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.