Date: Mon, 14 Oct 2002 00:00:36 +0100 From: Daniel Bye <dan@slightlystrange.org> To: freebsd-questions@FreeBSD.ORG Subject: Re: Slightly OT: How to remove an odd file... Message-ID: <20021013230036.GB51228@catflap.home.slightlystrange.org> In-Reply-To: <005b01c272d2$c67fad30$1500a8c0@dogbert> References: <3DA99893.3000304@attbi.com> <005b01c272d2$c67fad30$1500a8c0@dogbert>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Oct 13, 2002 at 12:08:29PM -0400, Brian McCann wrote:
> Yea...did it logged on directly as root. I think what happened is
> someone hacked the box via anon. FTP and made this program as a back
> door of some kind. :-/ I was able to 'chmod +w " " ' it, no errors
> there...but it yells when I try to rm it.
If you know the inode number (which I seem to recall you do, from the
start of this thread), and if the version of find on RedHat supports
the same sort of options as FreeBSD's find, you might try this:
# find . -inum <inode> -ok rm -f {} \;
You may need to tweak it, I haven't been near RedHat for well over
two years, so don't remember the niceties of any of its tools.
HTH,
Dan
--
Daniel Bye
PGP Key: ftp://ftp.slightlystrange.org/pgpkey/dan.asc
PGP Key fingerprint: 3D73 AF47 D448 C5CA 88B4 0DCF 849C 1C33 3C48 2CDC
_
ASCII ribbon campaign ( )
- against HTML, vCards and X
- proprietary attachments in e-mail / \
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021013230036.GB51228>