Re: C5 : Deleting un-deletable files ?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Sun, Sep 14, 2014, Always Learning wrote:
>
>Thank you to Steven and to Valeri for an excellent idea.
>
>The fsck cured the problem.  The problem files were removed by fsck
>during its recovery/rectification.

The first thing you should do when you find files or directories
is use 'lsattr' to check the attributes.  In particular look for
the 'i' attribute which marks the entry as immutable.  A favorite
trick of crackers is to put their own versions of commands such
as /bin/ps, /bin/ls, /usr/bin/find, etc. to hide their activity.

You can use the 'chattr' command to change the attributes with
something like 'chattr -i /bin/ps' to remove immutable attribute.
If there are multiple attributes shown by the 'lsattr' command,
simply add them like 'chattr -iAs /bin/ps'.  It also takes the -R
option to run recursively through a directory.

Bill
-- 
INTERNET:   bill@xxxxxxxxxxxxx  Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/  PO Box 820; 6641 E. Mercer Way
Voice:          (206) 236-1676  Mercer Island, WA 98040-0820
Fax:            (206) 232-9186  Skype: jwccsllc (206) 855-5792

The government is like a baby's alimentary canal, with a happy
appetite at one end and no responsibility at the other.
 -- Ronald Reagan
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos




[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux