Computer hacked - Can't remove files left behind

[kansasskydiver 0]

My server was hacked into again... I'm about to the pointof taking it down, but I think I've found the problem and where it's coming from.

Other than that, they've left behind about 2 gigs of crap and it won't let me delete. Says "Cannot delete: Cannot read from source file or disk"

Does anyone know a way around this? I'd really like to free up the 2 gigs.

Thanks, and yes, my firewalls are on, FTP is off, hardware firewall on my router. It's a problem with my message board

<--- See look, pink dolphins DO exist!

[Feeblemind 1]

Are the files attached to directories in use or are they seperate directories? If they are seperate you can go in via a dos disc and remove the directories (I had a trojen I had to kill that way).

Good Luck,

Phil

Fire Safety Tip: Don't fry bacon while naked

[kansasskydiver 0]

they are within my server directory, though not in use. I tried deleting through the cmd line and safemode. Neither would work.

I can't delete from the cmd line because the first 2 directories have no name, just blank. Then the other ones have a space, like R 23781 so I can't do a change directory.

What's even more of a pain in the ass is, my message board went down at 11:55. I posted a message on their boards requesting help, by 12:09 i had been bit again... So I find it a bit too convienent considering I don't have my message board location posted on my profile, would have been a direct ip grab. Assholes

<--- See look, pink dolphins DO exist!

[Kris 0]

What OS are you running on that server, Chris?

Sky, Muff Bro, Rodriguez Bro, and
Bastion of Purity and Innocence!™

[kansasskydiver 0]

XP all the service packs are up to date as well.

I'm having all kidns of problems. I restored my message boards, it restores the DB but won't read from it.

<--- See look, pink dolphins DO exist!

[waltappel 1]

Quote

I can't delete from the cmd line because the first 2 directories have no name, just blank. Then the other ones have a space, like R 23781 so I can't do a change directory.

You can change directories from the command line. Just enclose the directory name in quotes, e.g.,

cd ".\R 23781"

Walt

[kansasskydiver 0]

didn't work either

<--- See look, pink dolphins DO exist!

[CrazyIvan 0]

One thing you guys overlooked, that "space" might not be a space but a non-printable character (probably CHR$(255)) give that a shot.

also, check the ATTRIBUTES.

__________________________________________
Blue Skies and May the Force be with you.

[gravitational 0]

1. from a command prompt, type 'dir /x' in the directory where the little shitz did their work. This will give you a short file name (i.e. 'ta1174 ;;; . ' equals 'ta1117~1')
2. type the command 'rmdir ta1117~1 /s'
3. select Y for yes
4. Directory gone.
5. figure out how they got in, report the intrusion to their ISP with date and time (use GMT + or - where ever the server is) and keep everything locked down.

------
Michael