On Wed, 26 Dec 2001 11:47:25 -0800 Ed Kasky <[EMAIL PROTECTED]> studiouisly spake these words to ponder:
> What a holiday! Our box that runs our mail server was hacked on Dec. 23 > and we are still trying to clean up the mess... > > I know this may be a tad off topic so if you have an answer to this > question, you can always just email me privately. I just thought someone > here might know how to solve this one last issue. > > This particular server is running RH 6. They changed /bin/ps to something > that is totally different than what we had on there before and created a > hard link so that it can't be deleted or updated until we find the hard > link. My question is how do I trace this link so I can delete it, and then > reinstall the rpm???? > > Even forcing the rpm install returns the following: > > # rpm -i --force /test/procps-2.0.2-2.i386.rpm > can't rename /bin/ps to /bin/ps-RPMDELETE: Operation not permitted > unpacking of archive failed on file /bin/ps: cpio: unlink failed - > Operation not permitted > > Thanks in advance... > > Ed > ~~ Ed, have you tried going in at runlevel #1, umount the partition where "ps" lives and tried deleting it that way? -- daRcmaTTeR --------------------------------------------------------------------- If at first you don't succeed do what your wife told you to do the first time! Registered Linux User 182496 Mandrake 8.1 --------------------------------------------------------------------- 3:05pm up 10 days, 6:54, 2 users, load average: 0.23, 0.55, 0.54
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
