Home / ubuntu / Questions / 1359878
In Process
Ajay
Asked: 2021-08-25 08:00:03 +0800 CST

Suspecious hidden .swp file in usr/bin

  • 772

after I ran rkhunter it showed suspected hidden file /usr/bin/.piny.py.swp. After a little google I came to know that it is made by VIM. But at that time VIM was not installed in my system. Well I ran vim -r .piny.py.swp and the result looks something like this: /usr/bin/piny.py^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^MU3210^@^@^@^@#"! ^S^RU^@^@... continued. How can I see what all is this. Is there anything to worry.

Edit 1: Does .piny.py exist? Yes didn't exit normally? Yes it did not exit normally. I have to press CTRL + Z to exit

Further there was a line of "".piny.py" [noeol][converted] 1L, 12297C" at the end of file vi piny.py and this posts says: "especially including the last line. If there is no end-of-line (eol) on the last line, then it is an unusual situation and the file most certainly was not created by a standard UNIX editor."

vim

1 Answers

  1. The swp file can be created by vi as well. Someone (check the ownership and times) did vi .piny.py, and didn't exit normally. Does .piny.py exist? That might be a concern, otherwise just delete .pliny.py.swp

    Read man vi ex. Use of the .swp file is usually

    vi -r.piny.py.swp .piny.py
#
# or, using the default behavior
vi -r .pliny.py

    to recover .piny.py. .swp files are meant for vi, not for humans.

    Using ^Z simply suspends vi (so you can bg or continue it). Exit vi with ZZ, :wq, :q, or even :q!.

    • 1