windows 2000 and tagged dirs

[Quad]

If *I* were you....I would format and reload the server....then install Apache for NT if your company insists on NT. NT/IIS combos are trivial at best in regards to security. NT/Apache is a step forward but still lacking.

Also just check the attribs. on the directories that you cannot delete. They prob. just attrib +r each one so you cannot delete it.

-Q

[Guus]

Diablo, if that was it (attrib -r, or checking the read-only box off), please tell us, so I can give NoNeckJoe some +antipoints :)

That would've been the last thing I'd think of...

[petemcevoy]

Its more than attributes, why not give him the points anyway:-)

[ammo]

Out of curiosity, (in the same way of what magic1 said) what account owns these folders and what rights/permissions are set?

Ammo

[El Diablo]

alright I will give you guys some more info.

I have ownership of these files now, I claimed it as Admin. I removed the everyone group from having access, and of course granted myself full control over it and forced inheritence on all child objects. Also, the first thing I checked was the attrib on those files/dirs and removed the +a +s that was put there... but that still didn't help.

One thing that HAS helped was simply connecting through FTP and deleting them that way... but there are still some dirs that I can't get rid of, like the Com1, AUX directories.

petemcevoy has given the best link so far, as that is EXACTLY what my problem is. I am rooting around for a copy of the NT resource kit, but I seem to have misplaced my CD... personally I think someone at my last job "borrowed" it without telling me. I need to get the POSIX subsystem from it so I can start using some real commands to get rid of these dirs. I HAVE removed all of the files from the dirs though, and have reclaimed all of the space they were taking up... 6.2GB...

I had found the rm.exe and rmdir.exe on another website, but didn't install the POSIX subsystem, so that may be why they didn't work for me. I'm going to do just like the guy in the link from petemcevoy did.


Of course now my email server still isn't working because a dll is corrupted. If anyone has a copy of it let me know, it's abv_dg.dll it's used by Exchange 2000. It's located on the Exchange install disks, but wouldn't you know that disk is missing from work too and they haven't seen it in quite some time.


El Diablo
kicks some hackers, and upper management in the ass over this

[knightmb]

Borrowed from the info Pete gave.

I was able to recreate this on a windows2000 server using com1 as the directory name com1. It was located at C:\temp\com1

Well after that, I couldn't delete it from windows or the command prompt normally (with the remove directory command).

So I tried the extented commands, didn't need any resource kit for this one:

RD \\?\c:\temp\com1

That nuked the directory no problem, but that was the easy part. I tried making the same one with some high bit characters like the asci 255 and others so it had to changed as well to:

RD \\?\c:\temp\ com1©÷¡î¡¤

You will have to find out what high bit characters are embedded in the name for this to work properly. Didn't need the resource kit to remove the reserved word directory, so you might be able to fix it without the cd

[8*B@LL]

ok, im having some problems understanding this...i have tried every method i know to create a directory named "com1" or "com1 " or anything starting or ending with com1 on my win2k box...am i missing something? i tried the right click->new->directory and naming it "com1"...ive tried using the faux dos, no luck. i've also tried this on my girlfriends winME box...no go. what gives here? i was able to create [ALT]+255 + "com1", but that deleted just fine...
/me is confuzzled.

[El Diablo]

Originally posted by 8*B@LL
ok, im having some problems understanding this...i have tried every method i know to create a directory named "com1" or "com1 " or anything starting or ending with com1 on my win2k box...am i missing something? i tried the right click->new->directory and naming it "com1"...ive tried using the faux dos, no luck. i've also tried this on my girlfriends winME box...no go. what gives here? i was able to create [ALT]+255 + "com1", but that deleted just fine...
/me is confuzzled.

same here. I've tried to create these dirs, but the error I get is that the file already exists. I wanted to test some stuff.

The RD \\?\*... worked on SOME of the tagged dirs, but not all of them.

There are still some of the original COM, AUX dirs that are on there that I can't remove. Also, I was able to remove a lot of them through FTP, but telnet didn't do a thing. Some of those that I couldn't remove via FTP I could remove using the RD command.

Still confused over this one.

FWIW, I now have a copy of the POSIX commands and subsystem from the NT 4 resource kit. I'll try those out today and see what happens.


El Diablo

[Tedob1]

if the severs security has been breached that badly you have no choice but to take it down and do it over. Make sure every patch is installed before you reconnnect and watch it close, Theres gonna be some people mad at loosing their playground.

[Ghost_25inf]

Sounds like you have a big problem with security at work in and out of the computer world. I think I have that dll if I find it ill post a site up at geocites so you can dl it. But I do remember a site that had about every dll file known to man there, I found it while rooting around google.com something like, cracks or patches got me the right site. But I have a question for you where did you get the lock for the IIS? Im wanting to lock mine out but there is a message that pops up saying that some file was missing? who knows it was a burnt copy of 2000 anyways.