Windows 2000 server hacked

From: Rick Totedo (rick_at_alg.cc)
Date: 06/21/05 

Date: Tue, 21 Jun 2005 15:53:38 -0400

I have a Windows 2000 server that was hacked. The OS partition is on a 4
gig drive. The OS and profiles take up about 1.5 gig. When I look at the
drive properties, it says I only have 80 mb free. That means someone is
storing almost 3 gig of stuff on my omputer. I have used every tool and
command line I can to find the data, but nothing will read the directory
structure. All attempts come back displaying just the data that was
original to the system. The hackers must have done something to the system
to hide" their data from anything that reads NTFS. I also cannot empty my
recycle bin. It tells me that one of the folders is not empty. When I look
at that folder nothing is in it.

Does anyone have an idea on how to access this data so I can find it and
delete it from my system. As of now, I am looking at the format/reload
method, but I would rather not do that.

Thanks in advance.
Rick

Relevant Pages

  • Re: Windows 2000 server hacked
    ... setting so that it is showing hidden and system hidden files ?? ... The OS and profiles take up about 1.5 gig. ... It tells me that one of the folders is not empty. ...
    (microsoft.public.security)
  • Re: Memory: Stick fully inserted even though no click? One slot affects another?
    ... Is it normally possible for the levers at the ends of the ram slots ... empty, when it has 512M. ... A0 1 gig 512M ... suggesting that you install just the two new 1gb modules in the two ...
    (alt.sys.pc-clone.dell)
  • RE: Windows 2000 server hacked
    ... If that dos not show you any abnormalitys on your disk, ... The OS and profiles take up about 1.5 gig. ... It tells me that one of the folders is not empty. ...
    (microsoft.public.security)
  • Re: Windows 2000 server hacked
    ... way to accounting for it. ... The OS and profiles take up about 1.5 gig. ... It tells me that one of the folders is not empty. ...
    (microsoft.public.security)
  • Re: Windows 2000 server hacked
    ... Rick Totedo wrote: ... The OS and profiles take up about 1.5 gig. ... It tells me that one of the folders is not empty. ...
    (microsoft.public.security)