Think client got hacked...

[frosty7700]

One of my client's have a really bizarre problem on their NT Server. It is running IIS. Within the

http://wwwroot

directory, a folder was somehow created called " ;;; ... NuKeB TaG ... ;;; " or some similar hack-kiddie drivel, and beneath that another folder with a similarly cheesy name. THIS folder in turn contained more folders containing arachived (RAR, I believe) computer games...at least what appeared to be computer games based on searches on the directory names on Google. The running theory is that someone got onto this server and has tried to use it as a distribution point for ripped software, or merely did this as a prank. In any event, I set all of the stuff to Read-Only and cut off all access for Internet users. I also deleted the files and directories containing them. HOWEVER, the two parent folders described above won't die...whenever I try to do anything to them (delete, rename, move, etc.), I get a "cannot find specified file" error. I checked the permissions on them but can't figure out what the deal is. This is pretty messed up...though I am moderately impressed. I think I already plugged a rather glaring security hole that may have been used (or created...), but ideas for killing these folders would be nice.

 

[chiph]

There may be a process running that is holding those files open. Try a fresh boot, stop IIS and any other servers you've got running on the machine. If you still can't delete them, look at the process list (ctrl-shift-esc) and see if there's anything running that you don't recognize.

Chip H.

 

[mithrilhall]

Try renaming the files if possible. Then reboot into dos mode and try deleting or use deltree on them.

 

[Empeethree]

Try deleting them from the dos prompt with this format.

del \\.\drive\folder\file

ex.
del \\.\c:\temp\as\setup.pdf



HTH
Rob