PC Review


Reply
Thread Tools Rate Thread

How to delete files on a compromised ftp server

 
 
Guy
Guest
Posts: n/a
 
      3rd Mar 2004
Hi All,

I have a problem. My FTP server had become a dump site over the last
few weeks as I had rebuilt my computer and forgot to alter the FTP
access.
The info I have in the logs is

16:30:50 24.91.15.116 [105]USER anonymous 331
16:30:50 24.91.15.116 [105]PASS (E-Mail Removed) 230
16:30:50 24.91.15.116 [105]sent
/+++/CoM3.%d%f%g_T@GGED_+/+++++++CoM9.%d%f%o,%20.6++++++++/CoM3.%2EI9626,%20+l/+++++++CoM9.%d%f%o,%20.4++++/++CoM9.%d%o%f,%20.5++++++/++++/+++.._0nly_f0r_AM_,.+/+/The.Simpsons.Too.Hot.For.TV.2003.XviDVD/tmn-tsth.r00
226
16:35:11 24.91.15.116 [105]sent
/+++/CoM3.%d%f%g_T@GGED_+/+++++++CoM9.%d%f%o,%20.6++++++++/CoM3.%2EI9626,%20+l/+++++++CoM9.%d%f%o,%20.4++++/++CoM9.%d%o%f,%20.5++++++/++++/+++.._0nly_f0r_AM_,.+/+/The.Simpsons.Too.Hot.For.TV.2003.XviDVD/tmn-tsth.r00
226
16:35:11 24.91.15.116 [105]sent
/+++/CoM3.%d%f%g_T@GGED_+/+++++++CoM9.%d%f%o,%20.6++++++++/CoM3.%2EI9626,%20+l/+++++++CoM9.%d%f%o,%20.4++++/++CoM9.%d%o%f,%20.5++++++/++++/+++.._0nly_f0r_AM_,.+/+/The.Simpsons.Too.Hot.For.TV.2003.XviDVD/tmn-tsth.r01
226
16:39:45 24.91.15.116 [105]sent
/+++/CoM3.%d%f%g_T@GGED_+/+++++++CoM9.%d%f%o,%20.6++++++++/CoM3.%2EI9626,%20+l/+++++++CoM9.%d%f%o,%20.4++++/++CoM9.%d%o%f,%20.5++++++/++++/+++.._0nly_f0r_AM_,.+/+/The.Simpsons.Too.Hot.For.TV.2003.XviDVD/tmn-tsth.r01
226

I think it is taking up about 18GB on my computer byt I can't get into
the directories to see what has been put in there and also I can't
delete the directories.

All I can see under my ftproot directory are two directories with a
single _ in them. When I double click on these I get more of these _
directories. Then I finally come to what looks like the above except
it just says "com1.%20%f%5%o%g.". When I click on this it says that
the directory refers to a location that is unavailable. How do I get
around this please.

Thanks,


 
Reply With Quote
 
 
 
 
=?Utf-8?B?SmFtZXM=?=
Guest
Posts: n/a
 
      11th May 2004
I reviewed Microsoft Knowledge Base Article - 320081 -------- Cause 4, but this did not help me. I finally found a program called "Tritafile" at my last job that I downloaded. The program worked for me but I had to toy with it. I had to associate the folder with notepad to get past a "invalid date and time" error, I had to restart it a few times...but it did work..

I am running into this problem again at my current job and have so far not been successful. The file deletes with tritafile but then another folder appears in its place that has the same characteristics. I suspect a program is running that re-creates it but I have not be able to locate it

Anybody have any ideas?
 
Reply With Quote
 
Drew Cooper [MSFT]
Guest
Posts: n/a
 
      12th May 2004
Oh.exe is downloadable from MSFT. Sysinternals.com has handle.exe or
Process Explorer. All of them are free and any of them should be able to
tell you what process is opening a handle to the folder.
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


"James" <(E-Mail Removed)> wrote in message
news:5E698E55-A4D6-4F19-8AB3-(E-Mail Removed)...
> I reviewed Microsoft Knowledge Base Article - 320081 -------- Cause 4, but

this did not help me. I finally found a program called "Tritafile" at my
last job that I downloaded. The program worked for me but I had to toy with
it. I had to associate the folder with notepad to get past a "invalid date
and time" error, I had to restart it a few times...but it did work...
>
> I am running into this problem again at my current job and have so far not

been successful. The file deletes with tritafile but then another folder
appears in its place that has the same characteristics. I suspect a program
is running that re-creates it but I have not be able to locate it.
>
> Anybody have any ideas?



 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Delete files on web server by FTP zocker Microsoft Access VBA Modules 0 11th Aug 2010 10:58 PM
Compromised Web Server? Anybody recognize? John Kotuby Microsoft ASP .NET 5 8th Jan 2008 09:24 PM
Can't delete .dot files off intranet server... Fred Schreck Microsoft Frontpage 3 14th Oct 2003 06:42 PM
Re: Hacked server - cannot delete files Miha Pihler Microsoft Windows 2000 Security 1 18th Jul 2003 05:39 PM
Hacked server - cannot delete files Sparky Microsoft Windows 2000 Security 1 18th Jul 2003 05:35 PM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 10:33 PM.