undeletable files - even after fsck.ext3 -f (long)

[Alessandro Dentella]

Hi,

  sorry for the long mail but I'm really in an emergency and have no enought
  specific knowledge to understand what is happening.

situation
=========

  I have a samba server (debian etch, kernel 2.6.26) on which a user
  'silvia' has a profile that got corrupted in some way (see below). I
  wanted to get rid of the files but there is no way to delete them:

      srv-: # ll
      total 16
      ?---------  ? ?      ?                ?                ? compreg.dat
      drwxrwsr-x+ 2 silvia amministrazione  6 2007-06-08 18:33 extensions
      ?---------  ? ?      ?                ?                ? extensions.rdf
      drwxrwsr-x+ 3 silvia amministrazione 46 2007-10-31 16:16 ImapMail
      -rwx------  1 mauro  amministrazione 62 2007-03-28 15:53 impab.mab
      drwxrwsr-x+ 3 silvia amministrazione 26 2007-06-08 18:34 Mail
        
      srv-: # rm compreg.dat 
      rm: cannot remove `compreg.dat': No such file or directory
      
  I hava already used fsck (clean filesystem) and fsck -f (FILESYSTEM
  MODIFIED, but I think is just becouse it added lost+found)

  if I look for all files I obtain:

      # find ! -user silvia -ls
      find: ./guhdjtzd.default/extensions.rdf: No such file or directory
      find: ./guhdjtzd.default/extensions.rdf: No such file or directory
      53348196    4 -rwx------   1 mauro amministrazione  62 Mar 28  2007 ./guhdjtzd.default/impab.mab
      find: ./guhdjtzd.default/compreg.dat: No such file or directory
      find: ./guhdjtzd.default/compreg.dat: No such file or directory
      
copying files
==============

  I also tried to copy using 'cp -a dir_with_corrupetd_file /tmp' and I
  ended up 

     1. filling the / (It was way too big -- / is a diffrent filesystem/disk)
     2. a directory that cannot be deleted:

	srv-fossati:/tmp/pappo# rm -Rf M
	rm: cannot chdir from `.' to `M': Exec format error


orign of these file
====================

  Just in case it is of any help to diagnose the problem, the corrupted file
  have a very strange origin: they where found there with ownership
  'postfix' in a folder of the profile of 'silvia' in a directory of
  Thunderbird settings: at that moment (apart from the ownership that was
  not easy to explain) I could read the file (a normal mail message). What
  was strance was that I could see 2 occurrencies of that file using 'ls -l'
  so that I thought there was some unprintable char in the name and decided
  to delete it. After the attempt to delete it I obtained the situation
  described above.


What now?
=========

   I'm really lost. I don't have *any* idea of how to repare the filesystem
   or what can be the cause: virus? memory corruption on server (I tested it
   10 day ago due to some strange freeze, but resulted no error in 24 hours
   of memtest), controller (/ and /home are on different controllers).

   I'd be really thankfull for any possible hint

   Thanks in advance
   sandro

       

-- 
Sandro Dentella  *:-)
http://sqlkit.argolinux.org        SQLkit home page - PyGTK/python/sqlalchemy