Folks,
I'm cleaning up a system that was hacked (curses on wu-ftp!). There are a
number of files that cannot be reverted to their non-hacked form,
specifically, /bin/ps and /bin/netsat. If I try to delete them, for example
/bin/ps, I get this error:
rm: cannot unlink `ps': Operation not permitted
I've taken a look at status and get:
File: "/bin/ps"
Size: 33281 Filetype: Regular File
Mode: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/
root)
Device: 48,1 Inode: 108742 Links: 1
Access: Thu Jan 25 03:38:03 2001(00000.01:02:45)
Modify: Mon Jan 15 13:12:44 2001(00009.15:28:04)
Change: Mon Jan 22 19:47:13 2001(00002.08:53:35)
So, I guess this means that the file has a hard link to some other file.
Then I did a search for that inode:
find / -inum 108742 -print
but I don't find any other files that are linked to it!
There has to be some way to delete these files. What am I missing?
HELP!
Thanks in advance.
Cheers,
Mike
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
