Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

My server had been infected and the attacker spread a bunch of .5randomletters folders around my file system, with malicious code inside of them. I want to search for all the folders that begin with a dot, review them and then remove them.

How can I do that?

share|improve this question
2  
Thanks for all the answers. Both "find / -type d -name '.?????'" and "find /a/path -type d -iname ".*"" worked pretty well, but I decided to take Briam's advice and nuke it from orbit :) I'm putting these commands on my cheat sheet though! –  viniciusmunich - AssabetTech Dec 13 '13 at 8:29

4 Answers 4

My server had been infected and the attacker spread (...) malicious code (...).

NUKE IT FROM ORBIT!

That's the only way to be sure that everything is secure again. If you want you could make an image an analyze how the attacker got in the system but for that system the only salvation is reinstall from scratch. No removing only the "dot files" will make yourself secure that your system is oke

share|improve this answer
    
Does the OP have a Death Star handily available? ;-) I think the original quote was to '...Take off and Nuke the entire site from Orbit - its the only way to be sure...' - from Aliens (the film). –  Wilf Dec 20 '13 at 22:10
    
@wilf you obviouly don't know the meme. –  Braiam Jan 4 at 14:00

Use find to find all directories beginning with "." and followed by 5 characters:

find / -type d -name '.?????'

Note that your best option is probably restoring from backup and patching the hole they used to get in. Cleaning up a system can be nearly impossible, if the attacker is halfway competent. You should probably bring in an external copy of the find utility, in case it has been backdoored to hide these directories.

share|improve this answer
1  
+1 nuke it from orbit, it's the only way to be sure –  evilsoup Dec 12 '13 at 18:53

Use find:

find /a/path -type d -iname ".*"

where /a/path is the path into which you would like to search for the directories. In your case it would probably be /, -type d means search only for directories, -iname ".*" means with name starting with a ..

share|improve this answer

Before you "nuke it from orbit", I think you should find the leak first, so you can prevent incidents like this from happening again. So:

  1. Take the server offline
  2. Boot from a rescue disk
  3. Mount the infected disk
  4. Analyze, find the leak
  5. Clean install + harden + restore (data only) from backups

You should never boot the broken system again, only analyze it offline, just the disk data, from another system, and never run any executables on it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.