When I create a folder named system in my home folder, or in /tmp (can't try other locations as I am not root, but owner confirmed same problem even on root), ls -a will not show it. Also tried /bin/ls -a, same deal. Otherwise the folder "works" fine, I can cd into it, pwd shows the right location and everything. I can even rename it to something else and ls will show it then. But if I rename it back to system, ls will not show it anymore. Please note even if I remove the folder completely, or create it in a location where it previously didn't exist, with "mkdir system", it will not be shown by ls unless I rename it to something else. "echo *" shows the system folder. dir behaves same as ls (doesn't show the folder). Other folders with different names work fine and show up.

Distro is CentOS 5.6. I have another box with CentOS 5.5 and I DO NOT have this issue there. I don't think it's distro-related. I do not have root access but owner confirmed the problem on root as well.

Info about mount point from /etc/mtab: /dev/mapper/VolGroup00-LogVol00 / ext3 rw 0 0

  • How very bizarre. I'm extremely curious as to what's going on here. It sounds like something in the ls tool itself since echo * works. – Omnifarious Jun 3 '11 at 7:15
  • 9
    Sounds like a compromised box. – cnicutar Jun 3 '11 at 7:16
  • anybody know if this is a symptom of a rootkit? – ysth Jun 3 '11 at 7:17
  • @ysth I don't think it's a rootkit (bash globs it fine). – cnicutar Jun 3 '11 at 7:18
  • 2
    You should md5sum /bin/ls and check it against another CentOS 5.6. – Heandel Jun 3 '11 at 8:17

A simple alias ls="ls | grep -v system" would do it. Sounds like a prank or a rootkit. Were there any files within the directory?

  • An alias would not stop /bin/ls working, with the OP tried. – camh Jun 3 '11 at 13:34
  • Thanks for your answer. It was a rootkit (probably BeastKit). – mrbrdo Jun 11 '11 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.