FTP hacker strikes

[Guest_imported]

I found that a Thug was using my FTP site as a Warez site. I have shut him down, but now I have a problem of deleting his files. I try to delete the files and folders that he has uploaded, but I get an error saying that the file is not accessable. When I check securities, I still have ownership and full rights to the file. But there is not a file type listed. I tried to rename the files and they come up with the error,"parameter is incorrect". I did a little research and I was told that the files may have an illegal file name. What am I suppose to do from here. The files are 9 gigs in size.. How do I delete them?

 

[curious2]

don't know if this will work, but have you tried renaming the file? if successful, are you able to delete after renaming? just a suggestion...

 

[Guest_imported]

Yes and I get the error ,"parameter is incorrect".

 

[curious2]

sorry bout the rename question. i see that you already tried renaming the file. can you rename the directory and then get rid of the directory? Or do you already have files in that directory that you should not delete?

Before renaming the directory, i think you might have to shut down FTP services.

 

[Guest_imported]

I did try renaming the directories and FTP is shut down for now. Still can't delete these files.. Thank you though

 

[tom11011]

Boot from the CD into command line mode and try from there?

 

[hads]

Hi guys,

There is another thread that has some ideas on this - it might help you. Also I saw another one around somewhere, I'll see if I can track it down

thread96-88154

Cheers

Hads

 

[AlexIT]

I had a similar hack on a Win2K server once. I found that if you manage to delete the incorrect named file, it gets stuck in the recycle bin, that you cannot empty the recycle bin because of the special characters used in the file names. The easiest way is to delete this stuff is erase the parent folder containing the hack directory from a command prompt. (Then Scandisk and defrag to eliminate any trace.)

Alex