junk character(which is not readable)

[Lokesh_8]

Hello Friends,

Hope all of you are doing good.Well actually the thing is whenever I am using ll comand or ls command in the root directory of one of our server its displaying some characters too alongwith other filesystem and directories.What exactly is happening here can anybody tell me.

[Gavin Clarke]

Sounds like a tty setting to me.

Is it just the root dir?

[Lokesh_8]

Its not the tty problem its something else coming up only in / directory.Looks like ìà @â7à ?kô?ìoûká? these files has been created automatically on the same date and are of 0KB.Now tell me what should I do to remove this.

[Thayanidhi]

I suggest, investigate first how the files are created. I had very bad experiance of removing those files. I had files starting with ????? on the root. so I did "rm ????*" and every thing got removed!!!
If it doesn't harm you leave for now.
How many files are there?
Who is the owner/group?
Check your
Your post is not clear, may be redirect ll and post as attachment.

ll >/tmp/rootlist

Regds
TT

[Lokesh_8]

Hi

I am attaching the output please check it and now tell me what the hell is going on with this server.I am not able to diagnose it myself.

[Fedon Kadifeli]

I you have X (graphic) access to this server, log into CDE, run "File Manager", try to locate the file(s), and select "Put In Trash". You may later delete these files from /.dt/Trash using "rm".

[Gavin Clarke]

Does

find / -xdev -size -1 -mtime n

Where n is the number of days between now and when the files were created.

list those files and only those files?

[H.Merijn Brand (procura]

Those are non-ASCII characters:

00001690 20 20 73 79 73 20 20 20 20 20 20 20 20 20 20 20 sys
000016A0 20 20 20 30 20 4A 75 6C 20 20 31 20 31 31 3A 34 0 Jul 1 11:4
000016B0 39 20 E1 D7 5E 19 9C D7 A2 19 BF 08 FA 02 17 8A 9 ..^...........
000016C0 FD 0D 0A 2D 72 77 2D 72 77 2D 72 77 2D 20 20 20 ...-rw-rw-rw-
000016D0 31 20 72 6F 6F 74 20 20 20 20 20 20 20 73 79 73 1 root sys
000016E0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 20 0
000016F0 4A 75 6C 20 20 31 20 31 31 3A 34 39 20 E9 2B 7F Jul 1 11:49 .+.
00001700 FF FF 48 0D 0A ..H..

In the last file, the file *name* is E9 2B 7F FF FF 48

Try this:

# perl -e'opendir D,".";unlink grep/[\x80-\xff]/,readdir D'

Enjoy, Have FUN! H.Merijn

[H.Merijn Brand (procura]

And if you want to see the files before you actually remove them like that, do

# mkdir bad
# perl -MFile::Copy -e'opendir D,".";for(grep/[\x80-\xff]/,readdir D){move$_,"bad/".$f++}'
# cd bad
# ls -al
....
# cd ..
# rm -rf bad

Enjoy, Have FUN! H.Merijn

[Kent Ostby]

If you want to access a file, you can do this:

ll -i

The -i will cause the inum of the file to be displayed.

To remove it or do other things, you can do something like:

find . -inum ### -exec rm {} \;

For instance.

ll -i

893 -rw-r--r-- 1 hpcu dumps 1076 Jul 26 11:09 INDEX

To remove this file that has embedded characters in it:

find . -inum 893 -print

(this lists it so I'm sure its the right file)

then:

find . -inum 893 -exec rm {} \;


Best regards,

Kent M. Ostby

[Bill Hassell]

There is nothing wrong with your server. Unix allows users to create completely crazy file and directory names. Now this can happen with a touch command or vi or a bad script. To see the actual characters decoded, use ll -b. As far as I can tell, all of the gatrbage files are zero length and were created at exactly the same time. Since this is the / directory and NO ONE except root can create files and directories in /, you may have a root user problem.

Cleanup procedure:

1. CHANGE THE ROOT PASSWORD. Do not give it to anyone that is not properly trained.

2. Run logins -d to see if you have hackers with UID=0 logins or if someone has decided to give ordinary users root privileges. Disable those accounts immediately and then discuss alternatives such as sudo.

3. MOVE the home directory for root! It should NEVER be in / (even though HP and Sun and other Unix flavors default to /). It is a terrible security and stability risk to have root's HOME in /. (just think what happens with rm -rf *)

4. SET ROOT's umask!!!! All the garbage files have 666 permissions and there are several directories with 777 permission---very bad practice. Root's umask should be 077 or at the very least 022. Root should have to make a conscious decision to change the permissions on newlt created files and directories. Inconvenient? You are correct. Safe and secure? Of course. umask=0 is also a default for many flavors of Unix--just plain bad.

5. .rhosts is 777 - very, very bad. Anyone on your computer can read it and trash it. .rhosts MUST be 600. It is not executable and should not have write-bits set.

6. /home is 777 which means that any user on the system can trash any other user's personal directories (rename, remove, etc). /home must be 755, owned by root. The permission and ownership strongly suggest that people from the SAP or Oracle team were tryring to fix some sort of permission problem and used their Unix For Dummies book to set everything to 777 (which didn't help, but they left it anyway)

7. Oh, the garbage files...use ll -b to list the files without showing the special chars. Then alias the rm command to rm -i as in:

alias rm="/usr/bin/rm -i"

and then use filename matching to find the files. For instance, if there are severl 3 character filenames, use:

rm /???

which will then ask you for confirmation to remove the file (y or n). Now you'll get matches for /net and /hel, etc but just answer n to the files you want to keep. Repeat for longer names. In some cases, you'll have to use something like:

rm /*4*

for those longer names.

Now look at the last command to see who was logged in as root Jul 1, just before 11:49. Look at sulog too. Those filenames were created automatically by some script or command.