Server 2000 FTP folder hacked. Can't delete files "deposited" there.

[P. Graff]

Common practice for hacker to leave folders named after
O/S reserved words like COM1, LPT1, etc. and I've seen
the MS Tech Net on using DOS prompt to remove these:

http://support.microsoft.com/default.aspx?
scid=http://support.microsoft.com:80/support/kb/articles/Q
120/7/16.ASP&NoWebContent=1

However, the root folders left by the hacker are named
using some goofy characters (high order ASCII, I suspect)
that appear as spaces (like ASCII 255), though I can't be
sure. I mean, I can't CHDIR past the root folder to
where the COM1, LPT1 folders are so I can attempt the
removal using DOS.

I can reformat this drive, but what a pain.

Any ideas? Oh, I tried using metacharacters like * or ?
and it doesn't help.

Thanks.

 

[Steven L Umbach]

See this KB link on deleting reserved file names. Also see link to Karl's FAQ on this
subject and be sure to read up on parts about hardening and resecuring your computer
including disabling support for posix. --- Steve

http://support.microsoft.com/?kbid=320081
http://securityadmin.info/faq.asp#ftpfolder --- From FAQ.