6

I'm using Interpid (I know I need to upgrade). When I try and use the -h option with ls I get an error. I swear this used to work, and the man page says it should. Any ideas? 

$ sudo ls -lh
ls: invalid option -- 'h'
Try `ls --help' for more information.
Stefano Palazzo
  • 85,787
  • 45
  • 210
  • 227
FigBug
  • 303
  • 1
  • 3
  • 7
  • indeed it should work - does it work without sudo, in a directory readable by your user account? also, can you verify where the system is getting ls from by typing **which ls** and also **ls -l \`which ls\`** , also perhaps there is a strangely named file in that directory, does it affect all directories you try to run ls in? – Simon B Feb 07 '11 at 15:36
  • 3
    If you want to find out if your `ls` is compromised or corrupted, you could get a hash of the ls binary with `shasum /bin/ls` (check that `whereis ls` outputs `/bin/ls`), but I don't have Intrepid installed to give you the correct one to compare it to. – Stefano Palazzo Feb 07 '11 at 16:02
  • 2
    also check if ls is aliased to another command: type **alias** command to see which commands are aliased. – Simon B Feb 07 '11 at 16:06

1 Answers1

7

I expect you're dealing with the SHV5 rootkit.

Please run RootKit Hunter to check for rootkits.

Keep me informed.

Stefano Palazzo
  • 85,787
  • 45
  • 210
  • 227
Ilias
  • 1,328
  • 8
  • 10
  • 1
    Why '-1'? .. .. – Ilias Feb 07 '11 at 17:04
  • I get the following warnings: cbRootKit, SHV4 RootKit ,SHV5 RootKit – FigBug Feb 07 '11 at 17:09
  • @figbug - it's worth running rkhunter and chkrootkit and paste the full outputs onto pastebin and provide links to the pastebin files. if you suspect somebody has compromised your machine then the best action is to unplug it from the network to avoid data loss and further infection – Simon B Feb 08 '11 at 12:51
  • http://pastebin.com/U6vEqYSP http://pastebin.com/cEy1CWmn I am currently backing up and planning for format / reinstall – FigBug Feb 08 '11 at 15:11