[AccessD] OT: Been hacked

On 30 Oct 2005 at 18:18, Jim Lawrence wrote:

> I would normally not post this item here but I am not sure where I
> would find a more experience group.
> 
> It appears that one of my servers has been hacked. :-(
> 
> The first indication is, and it may be unrelated, is that one of my
> FTP directories that I have used for unloading and downloading files
> into has a 'Locked' directory in it. It is real simple to do this; and
> do not try it!
> 
> make a directory like:	 \temp\o0oKARo0o\here\
> and then rename like this:  \com1*\o0oKaro0o\here\
> (*=space)
> 
> Does anyone here know how to get rid of the thing?

Drop to a command prompt and

del \com1?\o0oKaro0o\here\*.*
rmdir \com1?\o0oKaro0o\here\
rmdir \com1?\o0oKaro0o\
rmdir \com1?\

-- 
Bryan Carbonnell - carbonnb at sympatico.ca
HAM AND EGGS - A day's work for a chicken; a lifetime commitment for 
a pig.