Date: Sun, 13 Oct 2002 12:08:29 -0400 From: Brian McCann <bjm1287@ritvax.isc.rit.edu> To: 'paul' <pkdb1@attbi.com>, freebsd-questions@FreeBSD.ORG Subject: RE: Slightly OT: How to remove an odd file... Message-ID: <005b01c272d2$c67fad30$1500a8c0@dogbert> In-Reply-To: <3DA99893.3000304@attbi.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Yea...did it logged on directly as root. I think what happened is someone hacked the box via anon. FTP and made this program as a back door of some kind. :-/ I was able to 'chmod +w " " ' it, no errors there...but it yells when I try to rm it. --Brian McCann -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG] On Behalf Of paul Sent: Sunday, October 13, 2002 12:00 PM To: freebsd-questions@FreeBSD.ORG Subject: Re: Slightly OT: How to remove an odd file... Brian McCann wrote: > No go...here's the listing for the file...here's what happens... > > -rwsr-sr-x 1 root root 64924 Sep 2 15:24 > > rm " " > rm: remove write-protected file ` '? y > rm: cannot unlink ` ': Operation not permitted > > Any other ideas? > I assume you did this as root/sudo? Strange that it's setuid . . . . -- Paul Beard / 8040 27th Ave NE / Seattle WA 98115 / paulbeard [at] mac [ dot] com / 206 529 8400 weblog @ <http://paulbeard.no-ip.org/movabletype/>; With a rubber duck, one's never alone. -- "The Hitchhiker's Guide to the Galaxy" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?005b01c272d2$c67fad30$1500a8c0>