UNIX for Advanced & Expert Users

One of my SCO 5.0.6 boxes was compromised and the hacker left behind several files that are hidden from ls and impossible to access using cd. There appears to be may spaces and other characters in the directory names that make it hard to see the files. The find command can see them as can tar but I cannot touch them. Below is an example of the file structure that I discovered. What tool can I user to reach these files?

Thanks in advance.
Gadgetman



/u2/RICARDO/rentone/RUN/tmp/ / ta13180- / -;; &20 @tagged .by; quit %f
;;...- / -Muh- / -ta0 % .; ; ;tan1- / ;% scanned by %d.- / -Muh- / con .; ;
;%d con- / -;made for .- / !n$!dR- / in12 /ComesTheStuff/Wimbledon MVCD/Wimble
don MVCD.part31.rar

you can either:

1. Enclose the files/directories names in quotes
2. use the find command with -exec rm/rmdir

You can pipe the output from 'ls -l' or just 'ls' through the copmmand 'cat -vet' to see any files with strange characters in

Code:

ls -1 | cat -vet

If you have problems removing files in a particular directory you can cd up a directory and do an 'rm -ir mydir' to interactively delete files within the directory. For example

Code:

cd /usr/mydir
ls -l
*produces rubbish output due to bad files/directories
cd ..
rm -ri mydir

The last command will recursivelt remove all files and directories from 'mydir', but will ask you to confirm each one. This may take some time if there are a lot of files and directories but it should work. Just dont delete anything you want to keep :-)

Thank you for your excellent suggestions, I decided not to waste any more time trying access the directories. Someone went to a great deal of trouble to “lock” them so I will concede them this petty if temporary victory. I made a tar backup and then nuked them out of existence. I will take another crack at them later when I have more time. I was up until 2:30 am last night learning the ways of the “t@gger” jedi. Know thy enemy and all. Quite a fascinating underworld they inhabit. See here http://www.jtpfxp.net/scanverify.htm and here http://old.wheresthebeef.co.uk/show....iracy-TYDJ.txt
Quite entertaining reading...
Gadgetman