Re: Was my FTP site hacked???
From: Karl Levinson [x y] mvp (levinson_k_at_despammed.com)
Date: Mon, 29 Sep 2003 20:05:31 -0400
Sounds like a hack to me. For more information, try:
"Ray MItchell" <RayMitchell@MeanOldTeacher.com> wrote in message
> I'm using Win2K and IIS with all patches up to date and
> have implemented an FTP server. I was stupid enough to
> leave it on all night with both read and write
> permissions. When I looked in my Inetpub/ftproot folder
> the next day there was a subdirectory in it I did not
> create. The strange part is that it does not have a name
> and I can't rename or delete it. When I try to delete it
> I get the message, "Cannot delete file: Cannot read from
> the source file or disk.". None of these are Read-only.
> I've tried deleting it in the safe mode as well as booting
> from my Win2K installation floppy. I've also tried ERD
> but nothing works. The unnamed directory has 10 levels of
> subdirectories. Most have meaningless names such as COMw8]
> pf, etc. The bottom four have the names, "Tag For
> Freak", "testtagg for FFG by Dia@g", ".up by", and "Tagged
> with PuBsMan-Board Tag It". The only file in any of this
> is in directory ".up by". The name of the file is
> simply "core".
> Does anyone know the significance of any of this? How do
> I delete this mess?
> Ray Mitchell