Help getting rid of an iffy directory please

I have a user with a directory called ‘Poster ??? Copy of files’
Clamscan said a file of the same name ( +html ) was infected and it got
rid of it so I wanted to get rid of the folder but nothing I’ve tried works.
Dolphin shows it but if you try and delete or rename it it says it isn’t there.
From the terminal you can’t mv or rm -rf even if you escape the ? characters
find . -inum ‘the inode number’ -delete wont as it’s not empty
sed -e ‘s/^A-za-v0-9.-]//g’ in a little script doesn’t work, trying to use
convmv didn’t do anything and you can go into the directoey to see what’s in there

Any suggestions please



It could be a link.
It could have weird ownership.
It could have weird permissions.

Check if a directory or a link and/or who owns it and/or if it has weird “permissions”: Right-click-the-mouse to see owner and permissions and the other bits.

They all look normal



What happens if:

  1. The GUI sessions are stopped;
  2. The Display-Manager service is stopped (either “systemctl stop display-manager.service” or simply “init 3”);
  3. The Clam AV daemon is stopped – does Clam AV have a systemd service?
  4. From a VT login as the affected user and, check the result of “file <problem file name>”.

It may be that, Clam AV has control of the file (a file which used to be a directory – directories are also files . . . ).

In the extreme case, you may have to shutdown to the “rescue” mode – “systemctl rescue” – and with the user “root” in the “most processes stopped” environment deal with the troublesome file.

Well, I’ll go to the foot of our stairs !

In init 3 my sed thing worked and I could get into the directory.
Then I deleted all the files by inode and once the directory was empty
deleted that by inode.

It never occurred to be that it would be different.

Many, many thanks


Let’s go back to the roots:

 > mkdir 'Poster ??? Copy of files'
 > ls -ld 'Poster ??? Copy of files'
drwxr-xr-x 2 xxx users 4096 27. Okt 10:31 Poster ??? Copy of files
 > touch 'Poster ??? Copy of files'/aaa
 > ls -l 'Poster ??? Copy of files'/
insgesamt 0
-rw-r--r-- 1 xxx users 0 27. Okt 10:31 aaa
 > file Poster\ \?\?\?\ Copy\ of\ files/aaa
Poster ??? Copy of files/aaa: empty
 > echo 'Something, somewhere' >> Poster\ \?\?\?\ Copy\ of\ files/aaa
 > cat Poster\ \?\?\?\ Copy\ of\ files/aaa
Something, somewhere
 > rm Poster\ \?\?\?\ Copy\ of\ files/aaa
 > rmdir 'Poster ??? Copy of files'

Please note that:

  1. Except for the ‘mkdir’ I used “bash” autocompletion (hit the <Tab> key) to generate the directory name strings.
  2. Within “bash” the >> ’ << (single apostrophe) character has a special meaning:

Words of the form $‘string’ are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard.

In other words when I typed “ls -ld 'Po” and then hit the <Tab> key, “bash” expanded the line to “ls -ld ‘Poster ??? Copy of files’”.
On the other hand when I typed “file 'Po” and then hit the <Tab> key, “bash” first expanded the line to “file ‘Poster ??? Copy of files’/” and, when I hit the <Tab> key once again, “bash” expanded the line to “file Poster\ ???\ Copy\ of\ files/aaa”.
[HR][/HR]Command Line Interpretors (CLIs) are wonderful, aren’t they?

Hi interele,

Perhaps the ‘?’-characters are not really question-marks, but something that cannot be displayed.

The ls-command has the switch ‘-b’ to print C-style escapes for nongraphic characters (from ‘man ls’).

So, try:

ls -b

in the directory that contains ‘Poster ??? Copy of files’ and see what characters that iffy directory name really has.

Kind regards,


Why not pass it to rm -r as an argument?

find . -inum [inode-number] -exec rm -ri {} \;

For the case of the ‘find’ action ‘-exec’, the golden rule is: “fully specify the command to be executed”.

IOW, first execute ‘which -a rm’ and then choose the “correct” ‘rm’ to be executed.For example, on this system, the ‘rm’ located in ‘/bin/’ is a link to the ‘rm’ located in ‘/user/bin/’ – the ‘find’ action ‘-exec’ should explicitly use the ‘rm’ located in ‘/usr/bin/’.

find . -inum [inode-number] -exec /usr/bin/rm -ri {} \;

[HR][/HR]I’ve violated my “on the seventh day one should take a rest” rule once again today . . .

Why is that?

Because some users and some system administrators feel that, CLI commands such as ‘rm’ need to be redefined to include by default “favourite options” to “make life easy”.

For very specific cases, such as the example in this thread, it is advisable to ensure that, the ‘-exec’ action of ‘find’ uses only the “real system CLI command” and not a “DIY” (Do-I-Yourself) version defined in a user’s ‘.profile’ or ‘.bashrc’ or in the case of a system administrator in ‘/etc/profile’ or ‘/etc/bash.bashrc.local’ (examples relevant only for “bash”) – ‘profile’ is the more universal source for such system modifications.

I understand the general idea, but once I’m invoking “rm” on a list of files, I’m already expecting it to do the worst possible thing (short of shred, maybe) to them…