Re: I cannot delete some files uploaded by some bad guy

From: Zaw Oo (zaw@kcconsultants.com)
Date: 03/11/02


From: Zaw Oo <zaw@kcconsultants.com>
Date: Mon, 11 Mar 2002 05:21:05 GMT

Xiaoxin Yin wrote:

> Hi,
>
> Several days ago I opened the IIS ftp server on my win2000
> prof. And I opened an incoming directory that accepts anonymous
> access. However, later I found somebody uploaded more than 600M
> files into the folder. And I cannot delete these files because
> win2000 reported the certain folders cannot be found!
>
> I believe it was a malicious attack because that guy named some
> folders as "suck" and transfered files from several different
> IP address. Now I have closed the service. I am wondering is
> there any way that I can delete these files? The files reside
> in some folders named "com1", "com2" and "com3". I can see them
> in the explorer. But the explorer dies when I try to open those
> folders.
>
> Thanks a lot,
>
> Xiaoxin

After trying, renaming, making sure having the permissions,
taking ownership, try these.

For deleting directory,
e.g. rd \\.\c:\suck\com1
and see if it works.

For the file,
eg. del \\.\c:\suck\com1\file.

These were from http://www.ntfaq.com.
Hope that helps.

-- 
Zaw Oo, MCSE, CCNA, A+, Network+
Senior Consultant
KC Consulting Group Inc.
http://www.kcconsultants.com