Cannot execute basic linux commands (ps, ls, ifconfig) - File not found

linux ubuntu filesystems

17,932

To cut a long story short, it looks like I was rooted by SHV4 / SHV5 rootkit. I will soon be formatted and reinstalling my box.

For future reference though, I was able to fix the file permissions by changing the file attributes (chattr -ais <filename>) and then changed the file owner back to root. The files were infected anyway though.

Thanks to all for you help and suggestions

17,932

Antony

Updated on September 18, 2022

Comments

Antony over 1 year
I am running Ubuntu Linux, and am having some major system issues (networking not working, etc), which I think could be based on this fundamental problem.

When I try execute a variety of basic commands (including ps, ls, ifconfig, locate), I receive the error 'no such file or directory'.

Here are some suggestions that I've found online, that I have tried without success:
1. I did a 'whereis ps' and found the file in the /bin/, and have checked that '/bin' appears when I do 'echo $PATH'
2. I did a filesystem check which showed my hard drive as being clean
3. I tried doing a 'sudo chmod 777 ps' but was told that I dont have permission. I don't think permissions for these files would have changed though (and I can't check as I can't run the 'ls' command).
Any help would be highly appreciated.
- Erik almost 13 years
  
  /usr/bin/ldd /bin/ls
- pconcepcion almost 13 years
  
  To try any command (I use ls in my example) you can try to do a whereis ls and try to execute it using the full path, like /bin/ls.
- Admin almost 13 years
  
  Maybe you are using some restricted shell? what is the output of echo $SHELL?
- mmmmmm almost 13 years
  
  What exactly is the output of echo $PATH
- LawrenceC almost 13 years
  
  cd into the directory and then prefix the command with an ./; i.e. cd /bin; ./ps.
Mr. Shickadance almost 13 years

How did you discover that? Could you please add some details?
Antony almost 13 years

After I changed the attributes and ownership of the infected files, I still couldn't execute them and that's when I realized that something else was going on. I noticed that the owner of the infected files (before I changed it) was '122' so I started Googling, found articles on the SHV4 / SHV5 rootkit, and noticed that all the files it infects (ps, ls, netstat, ifconfig, find, top, etc) were the ones with that owner.
Mr. Shickadance almost 13 years

Well, at least you identified it. Thanks for the follow-up.