Do yourself a favor... save your data and reinstall...
On Thu, 25 Jan 2001, Mike Pelley spewed into the bitstream:
MP>Folks,
MP>
MP>I'm cleaning up a system that was hacked (curses on wu-ftp!). There are a
MP>number of files that cannot be reverted to their non-hacked form,
MP>specifically, /bin/ps and /bin/netsat. If I try to delete them, for example
MP>/bin/ps, I get this error:
MP> rm: cannot unlink `ps': Operation not permitted
MP>I've taken a look at status and get:
MP> File: "/bin/ps"
MP> Size: 33281 Filetype: Regular File
MP> Mode: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/
MP>root)
MP>Device: 48,1 Inode: 108742 Links: 1
MP>Access: Thu Jan 25 03:38:03 2001(00000.01:02:45)
MP>Modify: Mon Jan 15 13:12:44 2001(00009.15:28:04)
MP>Change: Mon Jan 22 19:47:13 2001(00002.08:53:35)
MP>
MP>So, I guess this means that the file has a hard link to some other file.
MP>Then I did a search for that inode:
MP> find / -inum 108742 -print
MP>but I don't find any other files that are linked to it!
MP>
MP>There has to be some way to delete these files. What am I missing?
MP>
MP>HELP!
--
Chuck Mead, Owner, MoonGroup.com
[EMAIL PROTECTED]
GnuPG Public Key Available: http://wwwkeys.us.pgp.net
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
