2

When I create a folder named system in my home folder, or in /tmp (can't try other locations as I am not root, but owner confirmed same problem even on root), ls -a will not show it. Also tried /bin/ls -a, same deal. Otherwise the folder "works" fine, I can cd into it, pwd shows the right location and everything. I can even rename it to something else and ls will show it then. But if I rename it back to system, ls will not show it anymore. Please note even if I remove the folder completely, or create it in a location where it previously didn't exist, with "mkdir system", it will not be shown by ls unless I rename it to something else. "echo *" shows the system folder. dir behaves same as ls (doesn't show the folder). Other folders with different names work fine and show up.

Distro is CentOS 5.6. I have another box with CentOS 5.5 and I DO NOT have this issue there. I don't think it's distro-related. I do not have root access but owner confirmed the problem on root as well.

Info about mount point from /etc/mtab: /dev/mapper/VolGroup00-LogVol00 / ext3 rw 0 0

8
  • How very bizarre. I'm extremely curious as to what's going on here. It sounds like something in the ls tool itself since echo * works. Commented Jun 3, 2011 at 7:15
  • 9
    Sounds like a compromised box. Commented Jun 3, 2011 at 7:16
  • anybody know if this is a symptom of a rootkit? Commented Jun 3, 2011 at 7:17
  • @ysth I don't think it's a rootkit (bash globs it fine). Commented Jun 3, 2011 at 7:18
  • 2
    You should md5sum /bin/ls and check it against another CentOS 5.6. Commented Jun 3, 2011 at 8:17

1 Answer 1

1

A simple alias ls="ls | grep -v system" would do it. Sounds like a prank or a rootkit. Were there any files within the directory?

2
  • An alias would not stop /bin/ls working, with the OP tried. Commented Jun 3, 2011 at 13:34
  • Thanks for your answer. It was a rootkit (probably BeastKit). Commented Jun 11, 2011 at 22:38

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.