Re: Was my FTP site hacked???

From: Karl Levinson [x y] mvp (levinson_k_at_despammed.com)
Date: 09/30/03


Date: Mon, 29 Sep 2003 20:05:31 -0400


Sounds like a hack to me. For more information, try:

http://securityadmin.info/faq.htm#ftpfolder and
http://securityadmin.info/faq.htm#hacked
http://securityadmin.info/faq.htm#re-secure
http://securityadmin.info/faq.htm#harden

"Ray MItchell" <RayMitchell@MeanOldTeacher.com> wrote in message
news:14ad01c38657$532890b0$a401280a@phx.gbl...
> Hello,
>
> I'm using Win2K and IIS with all patches up to date and
> have implemented an FTP server. I was stupid enough to
> leave it on all night with both read and write
> permissions. When I looked in my Inetpub/ftproot folder
> the next day there was a subdirectory in it I did not
> create. The strange part is that it does not have a name
> and I can't rename or delete it. When I try to delete it
> I get the message, "Cannot delete file: Cannot read from
> the source file or disk.". None of these are Read-only.
>
> I've tried deleting it in the safe mode as well as booting
> from my Win2K installation floppy. I've also tried ERD
> but nothing works. The unnamed directory has 10 levels of
> subdirectories. Most have meaningless names such as COMw8]
> pf, etc. The bottom four have the names, "Tag For
> Freak", "testtagg for FFG by Dia@g", ".up by", and "Tagged
> with PuBsMan-Board Tag It". The only file in any of this
> is in directory ".up by". The name of the file is
> simply "core".
>
> Does anyone know the significance of any of this? How do
> I delete this mess?
>
> Thanks,
> Ray Mitchell



Relevant Pages

  • Re: restricting permissions for services in Win2K
    ... restricting permissions for services in Win2K ... I know that IIS for example requires system level access to ... it runs with any account to which the TCB ("Act as part of the ... > privileges are granted. ...
    (Focus-Microsoft)
  • Weird XP network issue
    ... sells a program that runs using IIS for the ... main system, running Win2K Pro SP4, IIS. ... as a workstation, ... virtual directory in IIS, and shares its' folder. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Requested resource in use
    ... > Win2K latest service packs ... > IIS 5.0 ... > Connecting to an Access DB *2003)- simple userlogin page, ...
    (microsoft.public.inetserver.asp.db)
  • IIS Woes
    ... I just got a new computer, preinstalled Windows XP Home Edition, which ... I went on the Internet and saw that others have gotten IIS to run ... I did this using the Win2K discs and WinXP directories. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Event Viewer Locked Files
    ... I have Tomcat connected to IIS on Win2K and the ... I can not delete or purge the log since it is ... mode that may allow me to delete the log from the command ...
    (microsoft.public.win2000.general)