I was hacked and now I cannot delete the files.

[Jeremy Brown]

Hello all,
The server of one of my clients was hacked via an open FTP site in IIS (a
Xerox repair guy opened it up to setup a network scanner. I wish I could
locate that guy now, so I could open him up.) I closed up the hole and
reconfigured the scanner, but the files the little dears left behind on the
server will not stand to be deleted. Whenever I try, I get "cannot read from
source file or disk". I have tried to remove them in a dozen different ways
including explorer, a command window and an FTP client, all to no avail.

I cannot take ownership of them and cannot change any settings regarding
them.

These files are taking up five gigs of space on the main hard drive (C:\)
and now a virus has embedded itself in the folders and refuses to go away
(the owner has a thing for graceful and artistic pictures of the natural
feminine form, and likes to download them to his PC. One of the ladies
didn't keep with her shots.) Norton has kept the file from doing any damage,
thankfully.

Any suggestions?

Jeremy

 

[TIMA]

the suggestion is to Ftp to your own pirated FTP site, and delete the
folders with an FTP program.
FTP programs can make these funky folders, and they can also delete them.

I have consistently heard that when you get burned like this, you should
reformat your drive and reload. You never know what passwords they got or
what trojans they left behind.

 

[Jeremy Brown]

I got the answer in another post, and here it is (they are):

http://rtfm.atrax.co.uk/infinitemonkeys/articles/iis/990.asp

________________________________________
Atrax. MVP, IIS (Jason Brown)

And

See:

How to Remove Files with Reserved Names in Windows:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;120716
You Cannot Delete a File or a Folder
http://support.microsoft.com/?id=320081

Jeff (Cochran)

Thanks to all...

Jeremy