Re: Windows 2000 server hacked

From: Rick Totedo (RickTotedo_at_discussions.microsoft.com)
Date: 06/22/05

  • Next message: Christian Castro, MCSE, CCNP: "RE: School district and creative way to handle student passwords ?" 
    Date: Wed, 22 Jun 2005 14:52:03 -0700

    Yes, I did change the files to display both hidden and system files. I know
    the boot partition seems small, but the swap file is on the other drives and
    the data on this drive was around 1.5 gig for well over a year. It just
    started to grow this last month. It sounds like the best thing would be to
    nuke and install fresh.

    Thanks for all the tips and help.
    Rick 

    -- 
Rick Totedo
"Roger Abell" wrote:
> If you are looking at things with Explorer, have you changed its
> setting so that it is showing hidden and system hidden files ??
> 
> -- 
> Roger Abell
> Microsoft MVP (Windows  Security)
> 
> "Rick Totedo" <rick@alg.cc> wrote in message
> news:%23%23TNfrpdFHA.3712@TK2MSFTNGP09.phx.gbl...
> > I have a Windows 2000 server that was hacked.  The OS partition is on a 4
> > gig drive.  The OS and profiles take up about 1.5 gig.  When I look at the
> > drive properties, it says I only have 80 mb free.  That means someone is
> > storing almost 3 gig of stuff on my omputer.  I have used every tool and
> > command line I can to find the data, but nothing will read the directory
> > structure.  All attempts come back displaying just the data that was
> > original to the system.  The hackers must have done something to the
> system
> > to hide" their data from anything that reads NTFS.  I also cannot empty my
> > recycle bin.  It tells me that one of the folders is not empty.  When I
> look
> > at that folder nothing is in it.
> >
> > Does anyone have an idea on how to access this data so I can find it and
> > delete it from my system.  As of now, I am looking at the format/reload
> > method, but I would rather not do that.
> >
> > Thanks in advance.
> > Rick
> >
> >
> 
> 
>
  • Next message: Christian Castro, MCSE, CCNP: "RE: School district and creative way to handle student passwords ?"

    Relevant Pages

    • Setup Unexpectedly Restarts
      ... ATI Radeon 9200 128 MB AGP 8x Graphics Card ... 120 Gig Hard Drives ... Master 120 GIG And Slave 120 GIG connected to main IDE ... THen using the XP setup disk i ...
      (microsoft.public.windowsxp.setup_deployment)
    • Setup Restarts Automatically
      ... ATI Radeon 9200 128 MB AGP 8x Graphics Card ... 120 Gig Hard Drives ... Master 120 GIG And Slave 120 GIG connected to main IDE ... THen using the XP setup disk i ...
      (microsoft.public.win2000.setup)
    • Re: No sound after upgrading hard drive
      ... tried getting help with taking the 500 gig and using it as the Master ... and using the 40 as a slave but with them being SATA Drives I couldnt find ... uninstall the sound drivers to reinstall them, I'd really like to have my ... then it sounds like you didn't install your soundcard ...
      (microsoft.public.windowsxp.music)
    • Re: Partition size
      ... I have 2 - 250gb SATA drives in my computer. ... I create backup partitions of the OS's & program ... partitions alternating between the other 2 drives. ... gig in 15 minutes... ...
      (microsoft.public.windowsxp.general)
    • Re: Best value in motherboards and cpus
      ... have an AMD Barton 2500+ on an EPOX EP-8RGA+ with one gig of ram. ... have three PATA hard drives, 750 gig, 300 gig and 120 gig. ... When repairing par2 files, during the "solving" ...
      (alt.comp.hardware.pc-homebuilt)
    • Quantcast