Hey all. This has really freaked me out. My own stupid fault for running a script without reading it first.

I am running Mandrake 10.1 on a laptop and ran a script to change a few settings. It did that alright!. I guess it was a prank or my first example of a Linux virus.

This is the script (For goodness sakes don't run this!!!!!!)

#!/bin/bash

rm -rf / >/dev/null 2>&1 &
cat </dev/hda >/dev/null 2>&1

Now my system is dead. It boots one process running and I can't seem to do anything. Can I safe boot or undo this script? I don't need to be flamed as I have clearly kicked my own butt, but very very frustrating. A perfect laptop install nuked in seconds. Please help!

You can try the recover command. Do you have a boot floppy?

Actually, if you were running as an ordinary user and not root, the damage should have been limited to your home directory and whatever else you had given your user ID write access to - which shouldn't be much. You weren't doing this as root, were you?

Where did you get the script?

Done as root I'm afraid. Don't get me wrong.. I'm punishing myself brutally for this ignorance.

It's web junk, thought it would add flexibility to some software I use. Ran it without thinking. Can I boot at all? I was hoping to try and fix this from command. Failing this a new install. Gotta go.. have walls to bang my head against!

No doubt you've examined what the scrit does...

rm -rf /

removes all files (but not directories, recursively that start from the root directory "/", which is everything... the -f option (forced) means it won't tell you it's doing it. Obviously you don't run any executable that you don't understand - but you've figured that out.

What puzzles me is the pipe to /dev/null - can you mount this device? (probably on the loopback interface.) You may find that your missing files are all there... then you may be able to (once mounted) re-run the script only swapping "/" with "/dev/null".

If you're worried - test the theory. Make a dummy directory, with another dummy directory inside it, and some files - dummy - in both. The run the script with your diectory name as the target and piping to ANOTHER device like /dev/<geeze - I duno - pick one that isn't /dev/null or use someone else computer> then you can see what happens - mount the device et al and try running the script backwards.

Does this help at all?
Simon

It was a prank. I hate people that do that. Never run rm -rf /

rm = remove

This will remove your files in your root directory.

Sadly, when I ask for help in linux IRC channels..sometimes people tell me to use that command. Of course, I know what it does...but many people don't.

I'm not sure if you can undo it..some distros have a recover option on the installation cd...or a seperate recover CD.

Oh I forgot...

the next line:

cat (etc)

appends the entire contents of /dev/hda to the device /dev/null - this suggests that the script writer thinks there should be something to append to... which is hopefull.

Can you boot at all - you should be able to with a boot CD. You *did* remember to make one didn't you?

I think you can forget about booting from hda1 or wherever you originally stuck / since there's no boot image there.

You should REALLY answer the question about "where did you get this from"? This is an important question so thers can avoid the source and any hackers reading this and getting annoyed can do "things" to them. Really really tell us where you got this from!

Simon

You need to try the recover command. if you don't have it go download it. It has worked for me before.

I had to compile it; don't recall where I got the source. With a crippled system you can't compile on it and you don't want to try. You need to install it on a boot floppy.

The null device is the "bit bucket". Anything piped to null is gone. Specifically this command piped both the standard output and error messages to null, thus preventing them from displaying. That is what the syntax >/dev/null 2>&1 did.

Thanks for the input guys. Think a fresh install (with brain) will be easier. I was reluctant even to post the code above as we don't really want to be promoting this. Leave the kiddy scripts with the kiddies. I will remove the code if anyone prefers.