Hacked FTP server -- need to delete directories.

[CFeyrer]

Hi,

We have an FTP server which was hacked and used to serve warez. Though I've had limited success using dir /x and deleting individual directories created by the hackers, I still can't delete some folders. For example, one named prn.hsp.laserjet.

I went to the parent directory, set permissions to "Administrator" and attempted to regain all permissions through the Windows 2000 GUI but got error messages saying the system could not find the file specified.

Any suggestions on how I can fully reclaim control of these directories and delete them would be greatly appreciated. Because there are so many, if you know of any automated tools to take care of such things I would appreciate those suggestions as well.

Thank you -

Christopher Feyrer

 

[mrdenny]

This is becuase the file starts with prn. This is reserved.

http://www.grouplogic.com/knowledge/index.cfm/fuseaction/view_Info/docID/111

About half way down will explain this part better.

I did this to myself once a couple of years ago. I beleive that I had to install the Posix support software, and use the posix commands to delete the offending file.

Good luck.

Denny

Between the ESP=ON and the RUM (Read Users Mind) upgrade, I'm ready to go.

 

[CFeyrer]

Thanks. Where would I find POSIX support software?

Chris

 

[mrdenny]

The old resource kit used to have it. I don't see it in resource kit for 2000. However the delrp command looks like it might take care of it for you.

Denny

Between the ESP=ON and the RUM (Read Users Mind) upgrade, I'm ready to go.

 

[greggb]

This happened to me too. The hackers were clever and created long file names that contained spaces, etc. I resorted to good old-fashioned DOS and listed the filenames and directories using the old eight character format - then you could delete them by using DOS DEL.