On Sun, Sep 14, 2014, Always Learning wrote:
>
>Thank you to Steven and to Valeri for an excellent idea.
>
>The fsck cured the problem. The problem files were removed by fsck
>during its recovery/rectification.
The first thing you should do when you find files or directories
is use 'lsattr' to check the attributes. In particular look for
the 'i' attribute which marks the entry as immutable. A favorite
trick of crackers is to put their own versions of commands such
as /bin/ps, /bin/ls, /usr/bin/find, etc. to hide their activity.
You can use the 'chattr' command to change the attributes with
something like 'chattr -i /bin/ps' to remove immutable attribute.
If there are multiple attributes shown by the 'lsattr' command,
simply add them like 'chattr -iAs /bin/ps'. It also takes the -R
option to run recursively through a directory.
Bill
--
INTERNET: bill@xxxxxxxxxxxxx Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way
Voice: (206) 236-1676 Mercer Island, WA 98040-0820
Fax: (206) 232-9186 Skype: jwccsllc (206) 855-5792
The government is like a baby's alimentary canal, with a happy
appetite at one end and no responsibility at the other.
-- Ronald Reagan
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
