Discussion Locked

Hacked

0 helpful
13 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Can someone tell me how to remove files that were put on my system by a warez hacker using my server as an ftp for his pirated software. I was able to remove of the files but some wouldnt let me delete them. Does anyone know how to remove this files. (they're mostly .mp3, .exe, .avi file extension but when I go to delete them it gives me an error that they couldnt be deleted for some odd reason.)

13 replies

by mrjay67

Make sure the files are not in use. Look in your Task Manager and see if they are runing in processes, kill them there if you can. Otherwise, go through the registry(run => regedit) and look for them there. Be careful if you are unsure of searching here. Deleting files you dont know can hose the PC. In regedit you can hit F3 and get a search box. Type the name of the files and get rid of them if they show up. Generally looking in hkey localmachine=>software=>Microsoft=>windows=> current version=>run Will yeild the results you want. However this is not always the case. If you find nothing there the best way to get rid of them is at a command prompt before you get into windows. If you are using NTFS you will likely need NTFSDOS or the like. You can try getting to the files through recovery console if you are using windows NT. If all else fails try using safe mode. Should be able to hit F8 while windows is just starting to load.(it should prompt you). That should take you to a menu with an option for safe mode. Nothing should startup except for neccessary items and should allow you to delete them there.

If for some reason none of this works and the files are not running in the background take ownership of the files(Assumingthis is NT now). Make sure you are logged in with Admin privlages. Right click on the files goto properties. There should be a tab for security. Go there and hit advanced tab. You should now see a tab for owner and in that tab you can take ownership if not already done. This process is for NT 2000 adv. svr. but should be similar for other versions of NT.

One of these steps should get rid of the files. I was spiting them out as they came to me so try the steps in order that is simplest foryou.

Jason

by acattr

this is not to help, but to clarify. I went thru the same thing. What they do is create files and folders that have invalid names. Example "filewithperiodnoextension." or " folderwithspacesinfront".

I also have been unable to remove these invalid entries. I also tried using a Macintosh to connect to it, as Mac's love to create invalid file names. But it also not allowed to delete them.

I would love to see what the answer is.

by acattr

FYI: answer 1 should help. I had to take ownership of the files and was able to delete them. But the folder structure still exists on my ftp server.

by chris.lewis

First thing to do is this (open a CMD.EXE window):

IISRESET /STOP

Which will stop the FTP & WWW servers.

Then try deleting the files with Explorer.

IF that doesn't work, in your CMD.EXE window, change directories to the FTP directory, and type

RD /S " bad file name"

by dont-bother

Me too. Couple years ago on a Windows NT Host.
You don't say, but I suspect you're using a web hosting company, and YOU are trying to delete the files via FTP. If so, it won't work!
You'll have to have the Sys Admin at the host delete the files and restore directories.
Blame Microsoft. I've never seen this on a Unix/Linux based system.

Good Luck.
I had to 'prove to the Web Hoster Sys Admin' that they weren't my files for distributing MP3s. (wasn't easily done!). They were going to bill me >$500 disk overage use.

IF this IS your case I can send you a copy of the letter I used to prove it wasn't me. It should give you some ideas (IF this is your case!)

by pacalealaathotmail.c

login as admin

check that you have the ownership/permissions in all the folders/subfolders in which there are files you wish to erase.

use winfile.exe imported from NT4 if you like GUI
or CLI (cmd.exe) if you are familiar with it.

hth

This discussion is closed to new replies.