Want to get rid of "non-existent" files and folders

Hi,

My Windows 2000 server has been hacked into recently. I was left with several
folders and files that, when attempting to delete as Administrator, will
not delete.

Instead, an error occurs that says "Cannot delete file: Cannot read from
source file or disk". When I try to look at the Properties for the file
or folder, it will tell me "Size: 0 bytes", "Size on disk: 0 bytes", and
created/modified/accessed date fields are blank.

Tried to use deltree or delete capabilities from DOS, but unfortunately Win2K's
DOS emulators don't seem to work the same as the real deal.

Can anyone help me get rid of these files, please?

Thank you

boot up into safe mode command prompt only and try it. Other than that i have no idea

Umm... another suggestion... they may actually be ghost folders created by bad clusters on your hard disk. I had random files and folders appearing on one of my computers for a while, and I did a chkdsk and discovered that there were a series of bad clusters. Once I fixed the clusters, I could delete the files and folders. To this day, I still don't know what files they were orphans of, but it couldn't have been anything too important since I didn't have any pseronal files on there. So, I recommend you run a scandisk or chkdsk to see if there's anything wrong with the drive.

AJ

What i have leard from prev situations like this all you hace to do is cut the folder and past it in the resicle bin

Well I do not know the nature of your hack, as in buffer overflow, exchange exploit PM the details. Be more specific as you feel comfortable with here. There are several tools (scripts) used at the CMD promt that can deal with Active Directories and issues. Do what was suggested use F8 to safe mode and manually delete from there. Or try this to delete folders note some modifications may be needed to reflect your system

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colFolders = objWMIService.ExecQuery _
("Select * from Win32_Directory where Name = 'c:\\Scripts'")
For Each objFolder in colFolders
errResults = objFolder.Delete
Wscript.Echo errResults
Next

Hi again,

I'll try out all the suggestions. Unfortunately, the server is remote, and I'm VNC (similar to PCAnywhere)'ing into the server at the moment, so any reboot of the server cuts off my ties to the server. When I can, I'll try make a trip down to the colo facility and do it there.

As for the chkdsk or scandisk, i'll give that a shot, probably schedule it at a certain time in the morning.

Thanks for all the suggestions :)

What were they called? Do they have messed up ASCII letters or are they just regular words?

There are several folders that have normal names on them like "tagged", "dont upload anything", etc, which are 0kb in size.

Inside the tagged folder ("Upped by <hacker name here>"), there is an errorlog.txt file that has a size of 1kb in the Details View mode, but has 0kb size in the Properties dialog box.

None of these files can be erased by normal deletion methods, but hopefully one of the proposed solutions will work, when I get a chance to test it.

Anyone know how these files/folders were created?

Much appreciated.

If you can, rename the files. It's a trick I have found usefull in this situation. The easiest way to break the 'protection' of something is to change it. If you can change the names you will be able to delete the newly named files.

Tried to rename, got error:

Error renaming File or Folder:
Cannot rename file: Cannot read from source file or disk.

Worth a shot, though, but I may have tried this in the past.

i remember an old trick with win95/98 was to use the extended ascii codes to type in characters that werent on a standard keyboard and for some reason windows wouldnt be able to do anything with the file....... i just couldnt read beyond its name, no files size, cant do anything to the files, there just stuck there. this only worked if you named the folder in dos (if you named it in windows it would do something that made it readable) then in dos you had to again rename the file to something normal to let windows read the file.......... take a look at 4DOS..... its a dos clone but has tabbed file name completion, in this way you can tell for sure if the file is really what its claiming to be........

just from the symptoms your stating thats what ive seen to do that so.......

Try this link if this will not delete the files and folders you may have to go to the server.
http://www.microsoft.com/windows2000...ng/delrp-o.asp

try to cut and paste the file onto an old 3 1/2 diskett. if it works format the diskett for reuse. thats how i got rid of a file stuck on my desktop.

thats the only thing i can think of off the top of my head. hope it helps.