PLEASE HELP, Take ownership of files

[sibbir]

one of our file server was hacked because it didn't have all the security updates. i believe i have took off all the services and updated everything where hackers don't have control of my server. now the problem is i can't access one of the disk drive "E:". it has total of 300GB and 100GB free space. i can't change ownership when login as domain admin. but i can see the files by \\servername\share_folder. its a NTFS drive. PLEASE HELP. thanks

 

[wdoellefeld]

Have you tried using the local admin account?

FRCP

http://www.frcp.net

 

[sibbir]

wdoellefeld, thanks for the reply. i tried to login as the local admin but still don't see any files on the drive. any other thoughts? Thanks

 

[moorethan]

Looks like NTFS permissions on the drive have changed. Make sure the permissions on the E: Drive are correct. Default everyone FC for root drive. Some change it to Administrator FC.
Try connecting to the admin share \\servername\e$ that may give you the access you need to correct the problem.

 

[sibbir]

moorethan, thanks for you reply. i've already tried that too but it doesn't show anything. only \\servername\share_folder shows the files. when i try to change the ownership it locks up.

 

[Buffman33]

Check the security policy to see who has "take ownership" privlege - Administrators group is the default, but this could be changed

 

[moorethan]

I take it the advanced permissions: security > advanced > view\edit are all correct as well. As Buffman33 mentioned check the take owner plus all the other advanced rights an admin should have are set correctly. Finally can you copy the data to another drive/area and do they inherit the permissions from the new folder. If so either copy to a new drive or backup and restore onto another area/server

 

[DebiJo]

Try an executable called chown.exe.

http://wwwthep.physik.uni-mainz.de/~frink/nt.html

It works where MS doesn't.....
Been there, done that.

Good luck,
Debi

 

[sibbir]

sorry for the late reply and thanks for your help. I finally got the problem fixed after talking to Microsoft. they had a tool called Wolf, which I ran on this Machine. It found hidden processes that were running on this machine which was preventing from taking ownership. I copied the data and formatted the server like Microsoft suggested.

 

[Wishdiak]

sibbir,

By "hidden processes that were running on this machine", do you mean spyware/malware/virus processes, or processes that were legitimate parts of the OS?

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[sibbir]

by hidden processes i mean processes that were placed by the hackers not the OS.