Server hacked

[astonmak]

Hi all,

I have opened the ftp service on my server and open port from the Firewall, originally it just for testing purpose, so i didn't put the authorization into it.

Then the bad lucky day had came, i think the hacker found me out and have store some folder and file into my ftproot, but I can't delete it away, it is a error about "the path not found", is there anyway about to remove those files and folder? (cause it take me out of space)

Indeed, where is the report to tell administrator about the users login history & activities for local users and internet users.

Thanks alot
Aston

 

[rubbaninja]

Try opening a command prompt, navigate to the root and do a wildcard delete before and/or after the filename

example:

cd c:\ftp
del *funkfolder*

There are illegal chars in the folder name which causes this issue.

I hope that helps

 

[Claudek]

From a command prompt, go into the root of where the folder is.
type dir /x
Now use the 8 letter name of the folder when using the delete command. You may have to go in further levels. Basically the folder name you see in Explorer is a fake name. By using dir /x you manage to see the real name in 8.3 format. Useful command that.



Claudius (What certifications??)

http://www.iteq.com.au

 

[jondel81]

I have the same problem. I can rename all the levels up to the "folders" I can't delete. This is what I get when I do a dir /x command on the directory:

04/02/2003 05:41a <DIR> .
04/02/2003 05:41a <DIR> ..
04/02/2003 05:41a <DIR> COM1
04/02/2003 05:41a <DIR> COM2
04/02/2003 05:41a <DIR> COM3
04/02/2003 05:41a <DIR> COM4

I tried red hat to delete them, but could not get authenticated with the file.

 

[astonmak]

Thanks, jondel81.

 

[jondel81]

I tried to do an &quot;rmdir /s/q&quot;
I get a:
COM3\AUX~1\AND_QU~1\NUL\BYABOR~1\njoy\ACIDLO~1.COM\al.tcim.part01.rar - Access is denied.

There are files that are numbered 01-14 in the same directory as above. The other directories appear to be empty.

Tried to change the permissions, but when clicking on the properties the tab isn't there.

Any ideas? (I did that command while logged on localy with Administrator account)