Windows Forum

Ask something
Discussion Locked

I've been Used!

0 helpful
17 replies

by ken wolf

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My NT 4.0 sp5 BDC Server has been compromised. A group of illegal software distributors has tried to turn my IIS 4.0 ftp site into a distribution point for their pirated software. I discovered the files uploaded a few days ago and have since modified the security on the site to allow access only from local clients. Reviewing the ftp log, I find where they created the directors and uploaded the files. My problem now is I am unable to delete the folders or individual files. I receive messages from Explorer that I cannont delete the folder access is denied. If I try to delete a different folder they created I get another message stating the parameter is incorrect. Another error states that it cannot find the file specified. I have tried from the command prompt, but access is denied to any of the folders. I believe this has something to do with the naming process when the folders were created. Here is a snippet from the log: sent /com1+/scanbybigboss/tag/by/-bigboss-+/for+fred's.t&co/mouarfff/UppedBy#Alladin#/Les+?vad?s/Les+?vad?s.r12. Any thoughts or ideas??
Thanks for any help
Ken Wolf, MCSE(NT4), MCP+I

17 replies

by mike (from canada)

back up your files you need, format the hard drive and then re-install the files. Also, scandisk might help by detecting and possibly fixing invalid file names.

by ken wolf

re-format is not an option at this point. This is an Exchange server and print server

by ken wolf

When I right click on the file or folder and select Properties nothing happens. Unable to get to the Security tab. In fact I am unable to get to the Properties for any of the files or folders on that machine now.

by curlergirl

Have you tried running scandisk (autocheck) on the drive where the files are located? It sounds like the files may actually be corrupt in some way, or at least the indices to the files. If so, running autocheck should fix them and put them in a state where you would be able to edit the permissions and take control so that you can delete the files. Hope this helps!

by ken wolf

synergy/dlo,
I think you have hit on the solution at lest part of it anyway. Friday I checked to make sure autocheck is running on boot, it is. Not being able to just reboot the server whenever I want, I decided to run chkdsk on the drive withoutany parameters (read only). Chkdsk did find and fix some error with the file system and it reported that it found errors but was unable to fix them. Probably because it is not able to lock the drive except on boot. However, I did go back to the folders and files and I was able to delete the files, but not the folder. I will schedule a reboot and run chkdsk. My guess is that it will fix the rest of the errors and allow me to delete the folders. Thanks for you input and suggestions.
Ken.

by stillatit

Note that the file/folder name shown has accented characters and forward slashes in it. Parameter incorrect says that the switch you entered (following the slash) does is not a valid switch for the del command.

Here are a few things to try:

1.Try renaming the folder/file to a simple short name, then try to delete it.

2. Try deleting it with a wild-card from a command prompt.

3. From the command prompt, try deleting the name with the name in double-quotes.

4. Check the permissions. From administrator, take ownership and change the permission to everyone with full control. Then try deleting.

5. (extreme) Use a disk editor (Norton or similar), to edit the directory entry to change the name. Don't try this without knowing exactly what you are doing.

Good luck.

by ken wolf

Stillatit,
Tried all of the above except #5. Without success. #5 would probably work if I had a disk editor and felt more comfortable using it. Thanks for the suggestions!

by mphoffar

Just a thought, but maybe stopping your IIS and FTP services before doing anything, like taking control, may help.

After that, I'd be with you in that this is some sort of bizarre file permission. Looking at the file name, I'd wonder if something as simple as changing the regional settings to a different language would help any.

Good luck to you

Mark

by ken wolf

Thanks for the reply and suggestion. I tried your suggestions, unfortunately they didn't work. Good thought though!
Thanks again

by ken wolf

Update: last night I tried using the command line utility cacls using parameters described in a MS Technet article to edit the security settings. That was unsuccesful also. I have found that if I log off and log back on again, I am able to accessthe properties page on files and folders. If I try to change the security for the affected folders it fails and I am unable to access the properties page for any other files/folders until I log off again. Also, when trying to log off I get a minimized explorer icon on the task bar and a "End Task" dialog box pops up prompting me to end the task.

by maxwell edison

Greetings,

I'm surprised that no one has looked at this violation of property from this perspective:

1. Call the FBI to report this sinister cyber-crime.

2. Report this to your insurance company so you can be in a position to recover any business related loss you've suffered up to now, and will suffer eradicating the intrusion.

Comparison:

If a thug threw a rock through your storefront window and camped out and/or stole your property (and/or space), how would you approach the issue?

Good luck,

Maxwell

by maxwell edison

.
.
By the way, the "technical" repair will become more obvious - and more palatible - after the aforementioned steps have been taken.

Regards,

Maxwell

by maxwell edison

.
.
More on cyber crime:

The following is an excerpt from USA Today.com:
Each day, there is an increase in the number of threats against our nation's critical infrastructures. These threats come in the form of computer intrusion (hacking), denial of service attacks, and virus deployment. Because of this problem, the National Infrastructure Protection Center (NIPC) was created (http://www.nipc.gov/). Located in the in the FBI?s (http://www.fbi.gov/) headquarters building in Washington, D.C., the NIPC brings together representatives from U.S. government agencies, state and local governments, and the private sector in partnership to protect our nation's critical infrastructures. Today, the FBI's Shawn Henry, Michelle Jupina, and Bruce Helman answer questions about computer intrusions and other cyber threats.
Editor's Note: Please do not use this forum to submit tips or leads to the Bureau. If you have any information to pass on, please contact the F.B.I. field office nearest you (http://www.fbi.gov/contact.htm).
See the entire article at: http://www.usatoday.com/community/chat/1130fbi.htm
http://www.serverworldmagazine.com/monthly/2001/11/cybercops.shtml

http://www.sans.org/infosecFAQ/infowar/infraguard.htm

by maxwell edison

.
.
Cyber crime and Insurance protection:

?...The growing financial losses caused by cyber crime, estimated by PricewaterhouseCoopers to have cost businesses worldwide more than $1.5 trillion last year. In Europe, 43% of companies see cyber crime as the biggest and most dangerous type of criminal activity of the future. "The bad guys have their sights set on the Internet as a way to terrorize or steal from us. Our responsibility is to thwart their evil intentions," he said. "At Chubb, for more than 20 years, we have led the charge against high-tech crime. As one of the world?s top insurers of both high-tech firms and financial services organizations, we believe there are effective measures that business and government can take ? independently and jointly ? to identify, quantify, control and finance cyber-related risks."

?...He urged companies to report cyber crimes to police despite fearing damage to their reputations. Otherwise, they will remain vulnerable to future crimes. Cyber insurance will provide the "last line of defense" to a company?s bottom line. Although insurance continues to evolve for cyber risks, eventually it will help to drive risk reduction.?

"To defeat cyber terrorism and crime, the emphasis must be placed on partnerships among business, government and law enforcement. That cooperation must exist both within, and beyond, the borders of any single country," he concluded.
The preceding is an excerpt from an article at:

http://www.chubb.com/news/pr20011017.html

It?s a good possibility that YOUR company?s insurance coverage includes damages incurred by a ?cyber? break-in.

Regards,

Maxwell

by ken wolf

Maxwell,
You certainly have a good point, I agree that this should be reported. I will and have been giving this serious thought. If I decide on reporting the incident I must first make the company president aware of the situation and let him decide is it should be pursued. I must admit a certain amount of embarrassment on my part for not having allowed this to happen in the first place. I found an article on the NIPC site that discusses reasons why Admins are reluctant to report these cybercrimes. I admit that the reasons given are some of the same reasons I hesitate to report the intrusion. Thanks for you thoughts and suggestions.
Ken

This discussion is closed to new replies.