Shulou(Shulou.com)06/02 Report--

Preface

Recently, our server was attacked by hackers, and then the properties of some files were modified so that we could not delete virus files, and even users with root could not delete them. Now record the solution.

Normal deletion

If the file belongs to the current user, you can delete it using the rm command

Rm-rf file.sh

If it cannot be deleted, try to delete it using the root user, and if it cannot be deleted, please see the instructions below.

Commands you need to know

If the normal deletion method does not work, then we need to know the following command to delete

Lsattr

The lsattr command is used to display the properties of a file, as follows

# list the attributes of file.sh files lsattr file.sh# lists the attributes of all files and folders in the current directory lsattr

Attribute description

After setting the I property, the file cannot be deleted or renamed, and the connection cannot be set to write or add data. Only root users can set the a property. After setting a property, the file can only add data, neither delete nor modify the data. Only root users can set A property A, if you access this file or directory, its access time atime will not be modified. It can avoid over-access to the disk by machines with slow I _ Band O. This is helpful for slower computers. After the s attribute setting, if the file is deleted, the S attribute setting will be deleted completely from the hard disk, and after the file is synchronously written to the hard disk (usually asynchronous) u attribute setting, the data content will still be stored on the disk after the file is deleted. You can retrieve the file e to represent the file as an executable file.

For more information, please refer to: https://baike.baidu.com/item/chattr/9841067?fr=aladdin

Chattr

Chattr is used to modify file attributes. Please switch to root user for this command. If you are a ubuntu user, you can modify it by adding sudo before the command.

# add I logo for file.sh file chattr + I file.sh# for file.sh file remove I tag chattr-I file.sh# add I for file.sh, a two IDs chattr + ia file.sh# remove I for file.sh files, a two IDs chattr-ia file.sh

For more information, please refer to https://baike.baidu.com/item/chattr/9841067?fr=aladdin

Actual operation

We learned from the above that we cannot delete the file when we set any of the I and an attributes, so we first remove the I, an attributes, and then perform the deletion:

# remove I, an attributes chattr-ia file.sh# to check whether the lsattr file.sh# removal file rm-rf file.sh has been removed successfully

If the file has not been deleted successfully, we need to consider whether the folder to which the file belongs has the I or an attribute set (which is really hard to find)

# return cd to the next level. # use the lsattr command directly to list the attributes of all files and folders under the current folder. # do not use syntax such as the lsattr folder, which lists the attributes lsattr of the files under this folder

If the folder is set, remove the properties of the folder, and then delete the files in the folder

Harvest

Although lsattr and chattr were found in the process of removing viruses, by understanding file attributes, we found that we can use file attributes to protect important files from being mistakenly deleted, and to ensure that files can be restored after erroneous deletion. If there is no effect after the operation of the file, we can try to solve it from the folder.

Summary

The above is the whole content of this article, I hope that the content of this article has a certain reference and learning value for your study or work, if you have any questions, you can leave a message and exchange, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.