Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server’s been hacked EMERGENCY

Which package does the file /lib/ belong to?

I need to replace it since it was infected. Same for /etc/sh.conf.

For now I have moved it to /temp/ Can I just delete it?

Edit 1:

I just found out that isn't a file but a directory with following files: bash shdcf shhk shrs

share|improve this question

marked as duplicate by Michael Hampton, Ward, Shane Madden, rnxrx, ewwhite Oct 11 '12 at 17:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Once a server's been compromised, you don't play around with the files here and there. You wipe it and re-install and restore your data files from backup. – Magellan Oct 11 '12 at 17:15
up vote 1 down vote accepted

Those aren't files I've ever heard of. Googling for brings up results related to the SHV4/5 rootkit. Here's a blog post detailing symptoms and removal

share|improve this answer
Yes, the files belong to rootkit, REMOVED immediately! – Danijel Oct 8 '12 at 21:53

What distribution do you have ? Matching file to package totally depends on package manager -> {and thus to distribution}.

In any case, for rpms (Fedora, Redhat, Centos ...) you can do it with rpm -qf /lib/

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.