File Deletion

[Jim]

One of my DMZ web servers (W2K Advanced Server) has been hacked on port 21.
They set it up as a FTP file server.

To make a long story short...they've been stopped but there are files on the
server I cannot delete.

I've used dir /x and tried to delete the short file name, tried rmdir, and
tried it in explorer. A Google of the web didn't turn up what I was looking
for. Namely a way to get rid of these files. (the first few directories
are '_' '__' '___', etc).

Any suggestions would be very welcome.

Thanks.

Jim

 

[Matthew Mucker [MSFT]]

Jim,

Call Microsoft support for help. We have a tool we can use to help you. I'm
not sure if the tool is available publicly.

You can also try doing an rd /s command on the parent folder.

-Matt

 

[Jim]

Matt,

Thanks for the quick response...greatly appreciated.

I'll try the rd /s and either call or email MS today. At this point I would
like to clean up the disk as much as possible before I take it out of
production for a rework.

Thanks again.

Jim

 

[Jim]

Matt,

There a phone number or URL to check on this utility? From the MS site the
only options they provide are pay.

Thanks.

Jim

 

[Steven L Umbach]

Perhaps this KB will help. --- Steve

http://support.microsoft.com/?kbid=320081

 

[Jim]

Thanks, Steve. I hadn't seen that one...I'll be checking it out.

Jim