/etc/passwd- & /etc/shadow- & /etc/group-
 

What are those files with dashes in the end? Google doesn't seem to handle this kinda spelling.

Hi,

Those are backups of the original.

Try the following command: diff /etc/passwd /etc/passwd- and you'll see that the dashed version still holds the oldest entry that was altered/removed.

Hope this helps.