Flexistentialism Welcome Guest | Login or Register

I opened up my IIS FTP server on my WinXP Pro PC to let some friends upload some music. What happens but the next day I take a look, and there are hundreds of tiny directories that have been made, with little files in them. Looks like some script kiddies had found my box, and were trying to use it as a repository for various crapulence. I summarily booted the 4 FTP users that were online, and began to delete the crap they had put on my drive. Often, a strategy used in this sort of behavior to keep the files around longer is to make directories with bad characters in the names, so that windows can’t delete them. Also, they will make directories with names like ‘aux’ and ‘com1’ which are reserved words. Windows won’t let you delete those directories either. I’m not much of a Windows guy, so it took a little bit of jerking around to get rid of those directories. If you try to delete them in Windows, you get the error “Cannot delete file: Cannot read from the source file or disk.” Which is a pain in the butt. Here was my strategy for cleaning up after the minor intrusion…

Open a command prompt, hit ctrl-alt-delete, find explorer.exe in the processes tab, and kill it. Close the task manager, and go to your command prompt. Navigate to the directory containing the little garbage files, and start deleting them. If you use “rd dirname /s /q” you will be able to get some of them right off.

If you can’t delete them that way, try listing the contents by doing “dir /x” which will list the 8 char names for the directories, use those names to delete more of them. Remember that the /s switch is for recursive, and the /q switch keeps it from asking permission each time. This method will help get rid of directories with bad names, or illegal characters in them.

If you are left with a few directories, chances are they have names like ‘aux’ or ‘com1’ or ‘com2’ or something. In that case, windows is not letting you delete them because those are reserved words. You can bypass reserved word checking by using the following syntax with the del or ‘rd’ commands: “rd \\.\driveletter:\directory” For example “rd \\.\d:\ftpshare\com1\” got rid of the com1 directory that was causing me trouble.

This Microsoft Knowledge Base article is handy, as is this article at JSI.

The final lesson is this: Never open up anonymous FTP uploading. Even just for a few hours. They’ll scan the open port, and be into your computer in a flash. Things were pretty well patched up, so its unlikely that they would have been able to actually cause any harm, but the annoyance factor that they were trying to use my computer as a storage depot is enough to make me glad they aren’t on my computer anymore. Though, I did get 5 albums uploaded by my friends. I should have just created user accounts for them though. I got lazy, and look what it got me!

Feed on comments to this Post