0

I recently found a strange file in my user home directory.

~$ ls -li
total 16
...
262994 -rw-r--r-- 1 user1 user1  0 Jul 14 12:13 ''$'\020\243''end'$'\202\243''row̹'$'\246''column'$'\316\001'
...

I can't open, move or delete this file by name. I will try to delete it using

find -inum 262994 -exec rm {} \;

but before that I would like to investigate further in order to find if my server is compromised.

Does anyone have similar experience?

Gfour
  • 1
  • This is a little undefined for a Q&A site. What's your question? – schroeder Jul 24 '22 at 11:23
  • If you have a new file on your Wordpress server, then you have been compromised. Period. Torch the server and rebuild from scratch. https://security.stackexchange.com/questions/39231/how-do-i-deal-with-a-compromised-server – schroeder Jul 24 '22 at 11:26

0 Answers0