What is the "-z" file on my system?

Question

I have a file simply called -z. It is an octet-stream file located in my home/user directory. Only root has access. I can't seem to open it with vim because it can't take the argument "z" (tried "-z" as well), or any other application.

What is it, what does it do?

Answer 1

Using "-<a letter from a to z>" as a filename is often used by malware to hide itself from casual observation. An octet stream a binary sequence of bytes. Opening the file in a text editor would show you the binary sequence of bytes it contains, but don't open this file because opening it could potentially harm your system or trigger malicious actions.

Uploading to and testing this file on virustotal.com may be helpful too.

It might be OK to delete this file, and then monitor your system to see if anything bad happens because you deleted it. The -z file's contents are simply a repeating pattern of ^@ so there's probably no risk involved in deleting it.

Make sure to back up the file in a different safe location before you delete it. Use a command like sudo chown username filename to change ownership of the file to your own user name. Use a command like chmod -x filename to remove executable permissions from this file. If the file is stored in a safe place, it can't do much damage to your system after making these changes. A safe place is any place where it can't get into your system like a USB thumb drive. Just don't plug the USB thumb drive into a computer and your operating system will be safe.

Answer 2

First of all, when working with any file of file that starts with a dash, that poses a small problem because a dash is used to denote options (like Vi's -r option) and so won't be taken as a filename. The simplest workaround for this case is to just prefix it with a ./ as in vi ./-z will open the "-z" file in vi without issue. Another common workaround with most software it to put file names after an argument of --. That is a common separator most software accepts to separate options from non-option arguments like filenames. So, the other approach is to use vi -- -z. The ./ trick should always work, but -- can be depend on the software to implement it, but it is quite common.

As for that file itself, I would think it's more likely something that was accidentally created when attempting to pass a -z option to it for whatever reason, but it was taken as a filename, possibly because it was given passed a -- or a > parameter. If you are concerned about it's contents, a safer option to examine it might be a program like hexdump -C or xdd. As you said you have opened it in Vim, it's not too likely it would cause any harm. If you see a bunch of ^@ symbols in Vim, that means the NUL control character which is just a byte of value zero. That could be from a variety of sources from allocating a file without writing any contents to it to being an empty disk image or similar. If that's all that's in that file, it's basically empty with no real contents.