I have a user with a directory called ‘Poster ??? Copy of files’
Clamscan said a file of the same name ( +html ) was infected and it got
rid of it so I wanted to get rid of the folder but nothing I’ve tried works.
Dolphin shows it but if you try and delete or rename it it says it isn’t there.
From the terminal you can’t mv or rm -rf even if you escape the ? characters
find . -inum ‘the inode number’ -delete wont as it’s not empty
sed -e ‘s/^A-za-v0-9.-]//g’ in a little script doesn’t work, trying to use
convmv didn’t do anything and you can go into the directoey to see what’s in there
It could be a link.
It could have weird ownership.
It could have weird permissions.
Check if a directory or a link and/or who owns it and/or if it has weird “permissions”: Right-click-the-mouse to see owner and permissions and the other bits.
The Display-Manager service is stopped (either “systemctl stop display-manager.service” or simply “init 3”);
The Clam AV daemon is stopped – does Clam AV have a systemd service?
From a VT login as the affected user and, check the result of “file <problem file name>”.
It may be that, Clam AV has control of the file (a file which used to be a directory – directories are also files . . . ).
In the extreme case, you may have to shutdown to the “rescue” mode – “systemctl rescue” – and with the user “root” in the “most processes stopped” environment deal with the troublesome file.
In init 3 my sed thing worked and I could get into the directory.
Then I deleted all the files by inode and once the directory was empty
deleted that by inode.
It never occurred to be that it would be different.
Except for the ‘mkdir’ I used “bash” autocompletion (hit the <Tab> key) to generate the directory name strings.
Within “bash” the >> ’ << (single apostrophe) character has a special meaning:
Words of the form $‘string’ are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard.
In other words when I typed “ls -ld 'Po” and then hit the <Tab> key, “bash” expanded the line to “ls -ld ‘Poster ??? Copy of files’”.
On the other hand when I typed “file 'Po” and then hit the <Tab> key, “bash” first expanded the line to “file ‘Poster ??? Copy of files’/” and, when I hit the <Tab> key once again, “bash” expanded the line to “file Poster\ ???\ Copy\ of\ files/aaa”.
[HR][/HR]Command Line Interpretors (CLIs) are wonderful, aren’t they?
For the case of the ‘find’ action ‘-exec’, the golden rule is: “fully specify the command to be executed”.
IOW, first execute ‘which -a rm’ and then choose the “correct” ‘rm’ to be executed.For example, on this system, the ‘rm’ located in ‘/bin/’ is a link to the ‘rm’ located in ‘/user/bin/’ – the ‘find’ action ‘-exec’ should explicitly use the ‘rm’ located in ‘/usr/bin/’.
Because some users and some system administrators feel that, CLI commands such as ‘rm’ need to be redefined to include by default “favourite options” to “make life easy”.
For very specific cases, such as the example in this thread, it is advisable to ensure that, the ‘-exec’ action of ‘find’ uses only the “real system CLI command” and not a “DIY” (Do-I-Yourself) version defined in a user’s ‘.profile’ or ‘.bashrc’ or in the case of a system administrator in ‘/etc/profile’ or ‘/etc/bash.bashrc.local’ (examples relevant only for “bash”) – ‘profile’ is the more universal source for such system modifications.
I understand the general idea, but once I’m invoking “rm” on a list of files, I’m already expecting it to do the worst possible thing (short of shred, maybe) to them…