InetPub/Scripts directory has over 42,000 files. Can I Delete?

[pixelp]

Im new to W2K servers so bear with me. Im used to Unix OS.
Im helping a company out with thier 2000 servers. Their C drive is full, in cleaning up I noticed that Inetpub/scripts has over 42,000 script files, most starting with TFTP or something like that. I have determined that this area is for ftp access and understand that this is where hackers can get info.
Can I delete these files? What are they? If its from hackers can I do some more research to determine from where? This company has been suspicious of hacker attacks so its possible.
I guess my overall question is can I delete these and if not what are they used for? Seems excessive.....
Thanks for any info!

 

[pixelp]

Ok, heres an update of what I have found out so far.
We were indeed hacked on Sept 18th, 2001. The hacker apparently wanted to change our default.html but we do not use our W2k server as an IIS Server so it went unnoticed until the C drive filled up.
The C drive was full of Trivial File Transfer Protocol files in /Inetpub/scripts
I have moved them off that drive for now to isolate them but all the default html files are now his obscene webpage.
I also noticed an Admin.dll file dated the same day. My other server does not have the .dll file on it (or any other extraneous files) so now Im wondering if I need to delete this as well to prevent further floods of the TFTP files.
Im checking into firewalls now but Im seriously considering shutting off the ftp port. But I have no idea how to do that. Any help is greatly appreciated!

 

[dmose]

Yeah, common problem with typical win2k installs...(pre sp2) is that it enables iis automatically. I'd suggest putting

http://WWW serivce/IIS

admin services on DISABLED, take any sharing you have on \inetpub off (default is c:\) - remove the admin share ($c) or reset the admin password asap.

On your firewall, depending on what type it is, blocking ports should be pretty straight forward. Firewalls usually block all incoming ports and its your responsibility to open/forward the ones you need for your various services.

I suspect this isn't the case with your firewall since you've had port21/80 open. My best guess is that you were hacked through port 80 because your win2k box isn't patched. Visit MS technet and get the latest patches.