3

This question already has an answer here:

My server had been infected and the attacker spread a bunch of .5randomletters folders around my file system, with malicious code inside of them. I want to search for all the folders that begin with a dot, review them and then remove them.

How can I do that?

marked as duplicate by Gilles 'SO- stop being evil' linux Oct 2 '15 at 22:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    Thanks for all the answers. Both "find / -type d -name '.?????'" and "find /a/path -type d -iname ".*"" worked pretty well, but I decided to take Briam's advice and nuke it from orbit :) I'm putting these commands on my cheat sheet though! – viniciusmunich - AssabetTech Dec 13 '13 at 8:29
21

My server had been infected and the attacker spread (...) malicious code (...).

NUKE IT FROM ORBIT!

That's the only way to be sure that everything is secure again. If you want you could make an image an analyze how the attacker got in the system but for that system the only salvation is reinstall from scratch. No removing only the "dot files" will make yourself secure that your system is oke

  • Does the OP have a Death Star handily available? ;-) I think the original quote was to '...Take off and Nuke the entire site from Orbit - its the only way to be sure...' - from Aliens (the film). – Wilf Dec 20 '13 at 22:10
  • @wilf you obviouly don't know the meme. – Braiam Jan 4 '14 at 14:00
7

Use find to find all directories beginning with "." and followed by 5 characters:

find / -type d -name '.?????'

Note that your best option is probably restoring from backup and patching the hole they used to get in. Cleaning up a system can be nearly impossible, if the attacker is halfway competent. You should probably bring in an external copy of the find utility, in case it has been backdoored to hide these directories.

  • 1
    +1 nuke it from orbit, it's the only way to be sure – evilsoup Dec 12 '13 at 18:53
4

Before you "nuke it from orbit", I think you should find the leak first, so you can prevent incidents like this from happening again. So:

  1. Take the server offline
  2. Boot from a rescue disk
  3. Mount the infected disk
  4. Analyze, find the leak
  5. Clean install + harden + restore (data only) from backups

You should never boot the broken system again, only analyze it offline, just the disk data, from another system, and never run any executables on it.

3

Use find:

find /a/path -type d -iname ".*"

where /a/path is the path into which you would like to search for the directories. In your case it would probably be /, -type d means search only for directories, -iname ".*" means with name starting with a ..

Not the answer you're looking for? Browse other questions tagged or ask your own question.