We keep getting hacked into......

We keep getting hacked into. We have a Sonicwall firewall, 4 servers(2 public, 2 private;all static IPs), & dozens of user machines. The same server has been hacked into each time. At first it was a public server hosting a website. After some a few changes we ended up moving the website to a diff server and made the hacked server a private server. within the last few days, the server was hacked again. I ran a trend micro virus scan and found 12 instances of sluter.b. I think thats how the hacker got back in but im not sure. does anyone have any idea what i can do to prevent this in the future? or if sluter.b is even how he got back in? the hacker also created a whole bunch of folders, one inside of the other, and i cant delete them. I get an error message. The root folder he created has no name at all. please help me. ty.

Maybe he has created a user name and logon for himself check user logins etc

Why do people always refer to hackers in the male tense hmmm

It may very well be sluter.b since it acts as a RAT. Check your firewall logs and look for anything suspicious. Did you remove sluter.b after the first attack or no, because if you didnt thats how he got in the second time probably. There always a chance a person thats working for/with you may also be doing this, and to add on to omen's post, check user logins becuase he may of created or compromised one. Is there anything in the folders he made, first thing that comes to my mind is hes using it as a warez server.

its a bad habit of mine to refer to anyone of unknown sex as a him. I just checked the users list and there are just the users we created. he/she may have figured out a password....

there is nothing in the folders. we are going to change all of the passwords just for good measure. The folders he made act pretty weird. If i try to navigate through them with a regular window, not windows explorer, the window crashes once i get to a certain folder. i dont have this problem with windows explorer. The names of the folders are prety odd as well. Here is the entire path that was created: C:\DataBackups\ \ \ \lpt3\~\com5\ScanneD \com7\by \com8\fisherman\com2\TaGGeD \com3\by \lpt1\TaGGeD_for_TC\com6\ \with Pappel-MaxPuB-TaGGeR \com3\uPPed \com7\BY \aux\fisherman . The blank spots are folders with no names. pretty weird eh?

i just found 2 folders with no names that i cannot open, it says access is denied. Im logged in as the admin. if i try to rename the folders it says Cannot rename file: Cannot read from the source file or disk. any ideas on how i can break into these folders?

how do you make folders with no names? I just tried using a series of spaces and it didnt work.

Wow, pretty interesting, make sure folder settings set to display hidden files because it might show some files in the folders and its always nice to know what they're up to.

i can see hidden files, but there are none right here. i cant believe that i cannot get into these folders. i tried to delete the parent folder and i got an error message saying that one of the no named folders cannot be deleted because it is not empty. trying from command line is useless because the folders dont have names....I'm stuck!

This may be of some help to you:

How to Remove Files with Reserved Names in Windows

Good luck.

Have you tried opening up the properties of the folders and giving the administrative account NTFS access? Even though you are logging in as the admin you can still setup NTFS files that the administrator cannot access without giving themselves permissions first.

Try using the secure shredder in Spybot S&D - or get one of your own shredders:

http://www.spychecker.com/program/necrofile.html

http://support.microsoft.com/default...b;en-us;320081

A bunch of reasons as to why you may not be able to delete the folders, scan through them.

Btw, im madly in love with your avatar phantom. :rolleyes:

thats really really close. for a minute i thought i was getting somewhere! I do have files that have invalid or reserved names. Unfortunately, the method for removal didn't work for me. I appreciate everyones help on this.

You may be able to use a function of Spybot Search & Distroy to remove these files. It has a 'Secure Sherreder' function that might remove completely all tracks of these files. I could not duplicate the 'no-name files' you have so I could not test this, but I did use an .exe file imbedded in 3 other folders and deleted it, by shredding the first folder.
You can get Spybot Search & Distroy HERE for free.
Ah ha fatphantom beat me to it....lol

ahhh.. the world of the scanners and taggers.. it's a most interesting world indeed.

FishTaco.. Status is right.. the warez doods hit you up and figured on using you as their warez server.

I did some research for you.. it took a bit for me to find it and I hope this is what they were doing to you because I really don't have much of a clue how it all works. All I know is that these guys/gals are getting pretty sophisticated with their techniques. I'm hiding this post and will be editing it later as I think this knowledge shouldn't be freely available..

This was taken from a post that was saved on a site that had tutorials on how to scan and tag servers to make a "pub". The site is now down. It shows how to lock directories and then how to break in or unlock them.. hopefully this is the technique they used on you.

Quote:

---

How lo make a basic locked dir:

info edited out

But they can still 'clone' and break in.

To clone a locked dir,

info edited out


Windows wont allow it, so if someone wants to clone your locked
dir they need to slip under Windows, i.e. in DOS, though if you work out a method otherwise, please dont be elitist and horde the knowledge amongst your friends.

---

good luck..

The directories may just have an unprintable character as a name. You can do this by holding down the ALT key while using the numeric key pad and entering a 3-digit ASCII code. For example the character inside these double quotes -->"_" is not a space, it's an ASCII 255 or 0xFF that I entered using the keypad. This is a common way of creating such directories.

One way of deleting them is with Winternal's ERD Commander product. Another is to use a low-level disk editor to view the directory entries and see what the name actually is. Then you can delete them from the command line using the ALT-keypad method.

Now I don't know if this is really the case with you - but it's a fair assumption.

thaks for all of the help folks. im certain that im on the right track now. But please, keep the info coming, there is always a chance that none of these possible solutions will work. ty.

what exactly is a raw command, and where do i use them? its a new one for me, or i never heard that term applied to it.

I have a BAT file here that creates such directories. The directories are out of the Windows GUI ASCII range. Using extended ASCII for the names causes Windows to use spaces, or other such things for the names. They can't be read from source, because the name to Windows is " ", but not to DOS. Remember, Windows is nothing but a GUI (a bad GUI) to DOS.
To delete them, do as an above post said, and get a low-level disk editor, or something of the like to delete them, or to atleast find the names of them, then delete them via command line.

anyone have any suggestions for a decent low level disk editor? im pretty ignorant on the subject.....

Well, after recieving your PM on the subject, I have collected the following:

Quote:

---

FishTaco wrote on Today 06:32 PM:
that makes a lot of sense. do you have a reccomendation for a decent low-level disk editor? also, do you know how i could prevent this in the future? ty

---

http://www.omnixray.com/
that site has what you should be able to use. (Low Level Disk-Editor)

http://www.sf-soft.de/winhex/disk-editor.html
The above is a disk-editor, but more hex/binary oriented.

As for prevention, there's no way, i know of to prevent the naming of the files as such, the only thing i can think of is getting hold of Portmonster 2.0 for a firewall.
http://www.zingsoftware.com

You may also want to invest in some decent antivirus software...Panda is the best I've found so far. There are also specialized programs for trojan removal to be found on google.

Panda Antivirus also supports free online scanning.
http://www.pandasoftware.com

oh my god...

i will tell you what you did (guess i will)
you ran or are still running an anonymous ftp on a windows machine (NT5)
the folders you are talking about /com1/ / / ... are build on winnt machines from ppl to store things on your machine nobody else should find.

so...if this is the only thing you got ,no problem, switch anonymous ftp off in your iisadmin.
if you need any specific help, just pm me .
if you want to and if you do trust me i will remove the folders for you.

if there is other intrusion you e.g. pointed the ftp the whole world could log in to your (asp????) website.
bad thing.

btw. no need of low level formatting.
only if these ppl are real a**holes and made the files undeletable on nt5 machine you have to format the partition.

Quote:

---

Originally posted here by AxessTerminated
I have a BAT file here that creates such directories. The directories are out of the Windows GUI ASCII range. Using extended ASCII for the names causes Windows to use spaces, or other such things for the names. They can't be read from source, because the name to Windows is " ", but not to DOS. Remember, Windows is nothing but a GUI (a bad GUI) to DOS.
To delete them, do as an above post said, and get a low-level disk editor, or something of the like to delete them, or to atleast find the names of them, then delete them via command line.

---

While this was the case with win95, 98, etc .... It is no longer the case with any operating system based on NT. DOS is no longer the underlying operating system.

I have tagged directories like this on an ftp which i can only access anonymously but i can delete and creat normal directories but i want to remove the tagged ones or view what people are storing on my server how do i delete or access.

Quote:

---

Originally posted here by FishTaco
there is nothing in the folders. we are going to change all of the passwords just for good measure. The folders he made act pretty weird. If i try to navigate through them with a regular window, not windows explorer, the window crashes once i get to a certain folder. i dont have this problem with windows explorer. The names of the folders are prety odd as well. Here is the entire path that was created: C:\DataBackups\ \ \ \lpt3\~\com5\ScanneD \com7\by \com8\fisherman\com2\TaGGeD \com3\by \lpt1\TaGGeD_for_TC\com6\ \with Pappel-MaxPuB-TaGGeR \com3\uPPed \com7\BY \aux\fisherman . The blank spots are folders with no names. pretty weird eh?

---

THIS part is the Warez directory. I know, a FTP server of mine was once comprimised and this is what was done...

as far as not being able to delete things due to "access denied" close your web/ftp server and try it again...