6

I'm using Interpid (I know I need to upgrade). When I try and use the -h option with ls I get an error. I swear this used to work, and the man page says it should. Any ideas? 

$ sudo ls -lh
ls: invalid option -- 'h'
Try `ls --help' for more information.
Stefano Palazzo
  • 88,573
FigBug
  • 313
  • indeed it should work - does it work without sudo, in a directory readable by your user account? also, can you verify where the system is getting ls from by typing which ls and also ls -l `which ls` , also perhaps there is a strangely named file in that directory, does it affect all directories you try to run ls in? – Simon B Feb 07 '11 at 15:36
  • 3
    If you want to find out if your ls is compromised or corrupted, you could get a hash of the ls binary with shasum /bin/ls (check that whereis ls outputs /bin/ls), but I don't have Intrepid installed to give you the correct one to compare it to. – Stefano Palazzo Feb 07 '11 at 16:02
  • 2
    also check if ls is aliased to another command: type alias command to see which commands are aliased. – Simon B Feb 07 '11 at 16:06

1 Answers1

7

I expect you're dealing with the SHV5 rootkit.

Please run RootKit Hunter to check for rootkits.

Keep me informed.

Stefano Palazzo
  • 88,573
Ilias
  • 1,326
  • 1
    Why '-1'? .. .. – Ilias Feb 07 '11 at 17:04
  • I get the following warnings: cbRootKit, SHV4 RootKit ,SHV5 RootKit – FigBug Feb 07 '11 at 17:09
  • @figbug - it's worth running rkhunter and chkrootkit and paste the full outputs onto pastebin and provide links to the pastebin files. if you suspect somebody has compromised your machine then the best action is to unplug it from the network to avoid data loss and further infection – Simon B Feb 08 '11 at 12:51
  • http://pastebin.com/U6vEqYSP http://pastebin.com/cEy1CWmn I am currently backing up and planning for format / reinstall – FigBug Feb 08 '11 at 15:11