Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

FTP Hacked, CANNOT remove, even w/POSIX

Status
Not open for further replies.

tcs1

MIS
Dec 8, 2002
10
0
0
US
Some WAREZ got hold of our FTP server when it was (hate to admit it, intentionally) left out in the clear with annonymous enabled for a day of testing and shakedown and have left some windows unfriendly files.

The folders placed contain spaces and are named "N 98502 ", "S 86250 " and " " (not named anything but the space, apparently). I have loaded the resource kit and attempted to remove these files with the POSIX tools therein contained, following what MS says to do as well as some of the posts I have found here previously, however, to no avail. The posix tools will delete anything I add, but NOT what the WAREZ added.....I have used dir/x to get the shortname and have tried deleting with this as well to no avail.....

ANYONE have a clue on this other than formatting and reloading? Thanks.
 
When you try to remove the folder are you getting a message telling you it cannot be found or are you getting permission denied?
 
Actually, either, depending upon the action taken. When we try to remove the three folders the prompt is from permissions; however when we try to remove the directory the error is from a "can't find source disk", indicating the files are not seen. Tried taking ownership definitively as well, but get the prompt that the folder cannot be found and am asked to ignore, ignore all, retry or cancel - with retry yielding nothing additional.
 
I know this might seem obvious but did you try to login with FTP client software with an account that has admin rights and delete it that way?
 
Check the registry for the file names. At least the ones that have names. Maybe they are in the registry and you can delete them there.
 
Good thought, but we tried the ftp client login idea as well. As to the registry entries, none were found. After this I believe the next time an ftp server is configured it will not reside on the main partition.....any other last ditch ideas? Thank you VERY much for your input to date.
 
I know this isn't any help at all, but I had the same problem, and searched high and low to find a solution on the net... none.

In the end, I had to redo the server anyway (for other reasons), and fixed that problem at the same time.

Sorry I couldn't be of more help.
 
rd /s c:\xxxx\ftproot

use rd /s on the ftp root directory. If that does not work go up one directory. This will delete the folder and all subfolders and files. It has to be used on a folder with a valid name, but will remove any invalid ones below it.

Bh2
"Act before there is a problem. Bring order before there is disorder."
~The Tao Te Ching
 
Thanks for the advise, but I already tried that and just now gave it another go to be certain. Reload "coming soon" to a server near you.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top