Re: MS IIS 5 server is hacked leaving undeletable folders and files

From: Duncan Hill <sf-incidents(at)cricalix.net>
Date: Thu Jan 02 2003 - 12:39:09 EST

On Tue, Dec 31, 2002 at 11:05:27AM -0600, Don Phillipe wrote:
> time to time I forget and leave this open (I know this is stupid but I

Windows doesn't like to remove files called aux (and other device file names).

As I recall, you need the posix tools or similar to be able to remove directories that share the same name as a device in Windows. The cygwin tools may be able to do it as well, but I don't remember.

Google, as always, is your friend:
http://www.experts-exchange.com/Operating_Systems/Q_20302910.html

Begin quote:
This MS KB article may help

BEGIN ARTICLE How to Remove Files with Reserved Names in Windows (Q120716)

---

The information in this article applies to:

Microsoft Windows 2000 , Professional
Microsoft Windows 2000 , Server
Microsoft Windows 2000 , Advanced Server
Microsoft Windows 2000 , Datacenter Server

Microsoft Windows NT Server versions 3.1 , 3.5 , 3.51 , 4.0 Microsoft Windows NT Workstation versions 3.1 , 3.5 , 3.51 , 4.0 Microsoft Windows NT Advanced Server

---

SUMMARY
Because applications control the policy for creating files in Windows, files sometimes are created with illegal or reserved names, such as LPT1 or PRN. This article explains how to delete such files using the standard user interface.

.
.
.
.

Additional Query Words 3.10 prodnt CON PRN AUX CLOCK$ NUL COM1 LPT1 LPT2 LPT3 COM2 COM3 COM4 winnt
End quote.

-- 

Sapere aude
My mind not only wanders, it sometimes leaves completely.
Never attribute to malice that which can be adequately explained by stupidity.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com

Received on Thu Jan 2 14:05:48 2003