[AccessD] OT: Been hacked

On 31 Oct 2005 at 6:22, Bryan Carbonnell wrote:

> On 30 Oct 2005 at 18:18, Jim Lawrence wrote:
> 
> > I would normally not post this item here but I am not sure where I
> > would find a more experience group.
> > 
> > It appears that one of my servers has been hacked. :-(
> > 
> > The first indication is, and it may be unrelated, is that one of my
> > FTP directories that I have used for unloading and downloading files
> > into has a 'Locked' directory in it. It is real simple to do this;
> > and do not try it!
> > 
> > make a directory like:	 \temp\o0oKARo0o\here\
> > and then rename like this:  \com1*\o0oKaro0o\here\
> > (*=space)
> > 
> > Does anyone here know how to get rid of the thing?
> 
> Drop to a command prompt and
> 
> del \com1?\o0oKaro0o\here\*.*
> rmdir \com1?\o0oKaro0o\here\
> rmdir \com1?\o0oKaro0o\
> rmdir \com1?\

DOH!! Been working with Linux too much these days.

Make sure that you cd to the directory where the "locked" directory 
is first.

-- 
Bryan Carbonnell - carbonnb at sympatico.ca
Accept that some days you are the pigeon and some days the statue.