Strange files appearing in /usr/bin

[Aziz Zouagui]

I was checking my backup the other day I found that my backup had some strange characters in its content, so I thought that my backup was corrupted. After I checked the "ls -li /usr/bin" directory, I got this:
----------------------
19028 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??K??
19029 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??E_T??=??
4
19024 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ????????
19027 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ???? ??
19020 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??K???K???
19031 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??K???!K???K???K???
19022 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??JW
19025 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??K5
19026 -rw-r--r-- 1 root sys 0 Apr 15 13:13 R]7??
19023 -rw-r--r-- 1 root sys 0 Apr 15 13:13 ??H884????O??
---------------------

I have no idea why those files got created initially, they have all been created at the same time, strange...

The question I have is this:

How do I remove these files ?
since I don't know how to pass their real name to the rm command. Can I remove them based on their inode number ?

Any help, would be greatly appreciated, thanks.

[Pete Randall]

Do a "rm -i /usr/bin/*" then very carefully answer no to all the files that you DO NOT WANT to remove and yes to the ones you do.

Pete

[Martin Johnson]

doing an "rm -i" will prompt you to confirm deleting the file. Type "y" to delete or 'n" to skip.

[Mark Greene_1 · Accepted solution]

alternatively to be extra careful, you can cd to the directory and do "ls >/tmp/badfiles"

and then edit the file /tmp/badfiles and remove the file names you DO NOT want to delete, and leave just the files to be deleted.

then you can do:
for FILE_NAME in `cat /tmp/badfiles/; do
rm -i $FILE_NAME
done

and answer y to the prompt to remove the file.

HTH
mark

[Aziz Zouagui]

I nuked them successfully by listing by editing the file and left only the ones I wanted to remove. They are now gone.

How do I check the entire system for the presence of thes strange files ?

Thank you for all your suggestions.

[Jeff Schussele]

Hi Aziz,

Just as a add on to this thread, I've found that these type files are generally created by some script gone amok.
Specifically I've seen some poorly written Expect scripts do this. Although I'm sure other type scripts could do this as well.
If you wish to track down the source you might investigate what scripts might have been run at the time these files appeared.

Rgds,
Jeff

[Martin Johnson]

Just an interesting aside, the "strange" file name I had the most difficult deleting was
"-", which the shell interpreted as an invalid parameter. I finally figured out "rm ./-" works.

Marty

[Mark Greene_1]

to locate any other files like this, cd to / and do:

find . \( -name [:space:] -o -name [:print:[ -o -name [:graph:] -o -name [:cntrl:] -o -name [:blank:]\) -print

hth,
Mark

[Aziz Zouagui]

Hi,

when I run this command
# find / \( -name [:space:] -o -name [:print:[ -o -name [:graph:] -o -name [:cntrl:] -o -name [:blank:]\) -exec ls -ltr {} \;

I get this error

find: bad option

By the way, what is [:space:] and [:print:] ?
What is being matched during this find command ?

Thank you.

[James R. Ferguson]

Hi:

You need a blank (space) character before the escaped closing parenthesis. See the man pages for 'find', its noted therein.

A regular expression of character classes is being used to match files. See 'man 5 regexp'.

Regards!

...JRF...

[Aziz Zouagui]

This command:
find / \( -name [:space:] -o -name [:print:] -o -name [:graph:] -o -name [:cntrl:] -o -name [:blank:] \ ) -print

Gives this output error:
syntax error: `)' unexpected


This command:
find . \( -name [:space:] -o -name [:print:] -o -name [:graph:] -o -name [:cntrl:] -o -name [:blank:] \) -print

Gives me the prompt back like nothing executed.

Either case with the space and no space none give me any results.