3

I have a file simply called -z. It is an octet-stream file located in my home/user directory. Only root has access. I can't seem to open it with vim because it can't take the argument "z" (tried "-z" as well), or any other application.

What is it, what does it do?

8
  • 2
    sudo vim -- -z doesn't work?
    – rusty
    Feb 25 at 14:51
  • I renamed it and opened it, but it is simply a repeating pattern of ^@.
    – Soda Party
    Feb 25 at 18:03
  • My question is: where did it come from? This, and especially this other threads are linked on this page as relevant, seems like the file command could reveal its origin? I don't know whether it's a good idea to touch it or not, I'm just observing.
    – Levente
    Feb 25 at 18:46
  • @Levente file only outputs virus: data (renamed -z to virus)
    – Soda Party
    Feb 25 at 19:05
  • Could it be that you (by mistake) once did sudo vim -- -z file while you intended to do sudo vim -Z -- file or something similar?
    – Raffa
    Feb 25 at 19:28

2 Answers 2

2

Using "-<a letter from a to z>" as a filename is often used by malware to hide itself from casual observation. An octet stream a binary sequence of bytes. Opening the file in a text editor would show you the binary sequence of bytes it contains, but don't open this file because opening it could potentially harm your system or trigger malicious actions.

Uploading to and testing this file on virustotal.com may be helpful too.

It might be OK to delete this file, and then monitor your system to see if anything bad happens because you deleted it. The -z file's contents are simply a repeating pattern of ^@ so there's probably no risk involved in deleting it.

Make sure to back up the file in a different safe location before you delete it. Use a command like sudo chown username filename to change ownership of the file to your own user name. Use a command like chmod -x filename to remove executable permissions from this file. If the file is stored in a safe place, it can't do much damage to your system after making these changes. A safe place is any place where it can't get into your system like a USB thumb drive. Just don't plug the USB thumb drive into a computer and your operating system will be safe.

5
  • 3
    Uploading to and testing this file on virustotal.com may be helpful too.
    – FedKad
    Feb 25 at 16:34
  • I uploaded it to both VirusTotal and Kaspersky, but both are stuck loading at 0 %. What do you mean by "safe place", won't any place on my system be a vulnerable place? See my reply to @rusty as well.
    – Soda Party
    Feb 25 at 18:08
  • @SodaParty A safe place is any place where it can't get into your system like a USB thumb drive. Just don't plug the USB thumb drive into a computer and your operating system will be safe.
    – karel
    Feb 25 at 18:09
  • 1
    Thanks, I thought you meant specific directories for a second.
    – Soda Party
    Feb 25 at 18:13
  • @SodaParty Yeah when there is a malware suspicion, I would stay away from USB drives, USB can be especially fallible to malware, I believe. Depending on the kind of malware, relying on USB storage devices may assist it in propagating itself, and it may reinfect cleaned equipment later, when the USB device is used again, I believe.
    – Levente
    Feb 25 at 18:37
2

First of all, when working with any file of file that starts with a dash, that poses a small problem because a dash is used to denote options (like Vi's -r option) and so won't be taken as a filename. The simplest workaround for this case is to just prefix it with a ./ as in vi ./-z will open the "-z" file in vi without issue. Another common workaround with most software it to put file names after an argument of --. That is a common separator most software accepts to separate options from non-option arguments like filenames. So, the other approach is to use vi -- -z. The ./ trick should always work, but -- can be depend on the software to implement it, but it is quite common.

As for that file itself, I would think it's more likely something that was accidentally created when attempting to pass a -z option to it for whatever reason, but it was taken as a filename, possibly because it was given passed a -- or a > parameter. If you are concerned about it's contents, a safer option to examine it might be a program like hexdump -C or xdd. As you said you have opened it in Vim, it's not too likely it would cause any harm. If you see a bunch of ^@ symbols in Vim, that means the NUL control character which is just a byte of value zero. That could be from a variety of sources from allocating a file without writing any contents to it to being an empty disk image or similar. If that's all that's in that file, it's basically empty with no real contents.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .