Can't get rid of directories...

[Tripitz]

I made a mistake and allowed write permissions enabled (I needed it for myself) for my FTP server. In the 4 hours I was away, it looks like someone uploaded porno movies onto the machine after many levels of directories. Unfortunately, it won't let me delete the directories. What can I do? I get an error stating that it "cannot read or write from source" Any suggestions?

[AirR']

can I have the URL of your ftp?

[Tripitz]

Originally posted by AirR'
can I have the URL of your ftp?

Hahaha.. no way. Its shutdown now. I'm kinda bummed about it. I really do need to figure out how to delete those dumb files.

[ua549]

Most likely you don't have full permission for those directories or their content.

Login as administrator, right click the folder, click the properties item, click the security tab, click the advanced button and take ownership of the folder. Then you can change the permissions and do as you wish with the folders and contents.

[Tripitz]

Originally posted by ua549
Most likely you don't have full permission for those directories or their content.

Login as administrator, right click the folder, click the properties item, click the security tab, click the advanced button and take ownership of the folder. Then you can change the permissions and do as you wish with the folders and contents.

Hey.. thanks for the advice in the other forum. I tried the full permissions thing and it did not work. I also did the dir /x which showed the name. They have names such as 0303~1 and C0C0~`. How do I delete it quickly? It won't let me as there are files 20 levels down (which would be a pain to get to by hand). Any ideas?

Its most certainly my fault that I got hacked. It was my first time playing around with the FTP manager and I allowed anyone access. I figured for a couple of hours I'd be safe... WRONG. I'm a bit bummed. In any event, I'm putting together a new PC tomorrow which I will put Server 2003 on and I will definitely do it the "right way" and lock it down.

now if only I can get rid of those directories quickly...

[Tripitz]

this is the file structure...

C:\Inetpub\ftproot\ \ \ \com4\F!@#OFF \con\ScanneD \com7\by \com1\Sh0rZ\com9\TaGGeD \lpt1\by \lpt1\Sh0rZ\con\ \with Neo1907´s PuB-tAgGeR \lpt3\uPPed \com3\BY \aux\Sh0rZ\com3

Past that point there used to be files which suddenly disappeared... Hmmm...

What do I need to check? I have all the services shut down related to the web and ftp.

[ewitte]

Originally posted by Tripitz
this is the file structure...

C:\Inetpub\ftproot\ \ \ \com4\F!@#OFF \con\ScanneD \com7\by \com1\Sh0rZ\com9\TaGGeD \lpt1\by \lpt1\Sh0rZ\con\ \with Neo1907´s PuB-tAgGeR \lpt3\uPPed \com3\BY \aux\Sh0rZ\com3

Past that point there used to be files which suddenly disappeared... Hmmm...

What do I need to check? I have all the services shut down related to the web and ftp.

I'm guessing you need a special utility to delete them. There is one based on Unix but I never found out where to get it. When I saw this last I had to move the real data off and format the partition. That was much easier than finding the program and figuring out how to use it.

Eric

Here you go. I did a little reasearch for you.

look for RM.EXE posix util

you can also try rmdir /S \\.\c:\inetpub\ftproot\LPT1~1.TAG (the short name may be different)

Even more info
http://support.microsoft.com/default...NoWebContent=1

[Tripitz]

Thank you very much!! That was very helpful.

So it turns out it is some German guy using a dial-in service from T-Online. He is still online from what I gather. It would be fun to leave a "present" on his pc, but too bad I like to follow the law.