FTP hacked folders created I can't delete???

[dante18]

Someone hacked my FTP server and created folders that I can not delete. I have fixed the hole but I can not delete the folders, I was able to delete the contents of these folders but there is no way to set permissions on these. I tried through a command prompt still no luck. Does anyone have any suggestions?

Thanks,
Dante

 

[ErikButler]

If you are admin of the Server you can take ownership of the folders and that should allow you to delete them. This is done by going to propeties of the folder then security\advanced options \owner tab set yourself as owner this should help Thanks
Erik Butler
2000 MCSE
erikbutler@centurytel.net

 

[dante18]

Erik, the clever little guys who created these made sure that there is no security tab in the properties page.

Dante

 

[ErikButler]

Then you might look at PGP file wipe it is a good cleaner as it the one with Norton Utilities. Also can you take owner ship of the directory that these folders are in and propagate the permisions to all subdirectories. Then if this dont work start looking at some dictionary password crackers. These are risky and if you decide this route i would make sure i have a goood antivirus program running when you download these. Hacks and cracker programs are notorious for trojans.
Thanks
Erik Butler
2000 MCSE
erikbutler@centurytel.net

 

[pollux0]

try running check disk

 

[ErikButler]

No i really dont think check disk is goin to do a heck of a lot for you. Another thought on the matter is this.

When you are try to view properties are you doing it on the ftp site or the actual folder( c:\ftpfolder) if you are looking at it from FTP window try normal windows explorer. You should be able to delete or take ownership if you are the administrator.

Thanks
Erik Butler
2000 MCSE
erikbutler@centurytel.net

 

[Guest_imported]

From a cmd prompt use the RESKIT utility "kill -f explorer.exe" this will release all file locks and you will be able to delete the unwanted physical directories/files. Type "start explorer.exe" to restart the explorer GUI shell.

 

[tom11011]

How did they hack the server and how did you fix the hole? Just curious.

 

[pollux0]

When a hacker did the same thing to us we found that check disk WORKED. The files the hacker wrote to the drive could not be deleted; the files created errors on the drives hence "could not be deleted". Check disk fixed all that!