Removing tagged folders from Inetpub\ftp root

Scott Smith · 2005/09/20

Some of you may be familiar with accidentally leaving anonymous log on enabled in ftp and getting your server hacked or tagged by punks.

It was a problem in win2kserver.

I Googled all over the place and have found no clear cut way to remove these folders.
Anyone have any experience with this?

Newt · 2005/09/20

Scott - this is not an area of expertise for me but so far I haven't found any file or folder that MoveOnBoot can't get rid of.

Scott Smith · 2005/09/20

Thank's Newt that was one of the first things I tried but I can't see how Move On Boot will allow you to delete folders just files.

Here is a better explanition of whats going on but I'm clueless of the remedy.

If you have an FTP site based on Microsoft IIS and you have a directory which can be uploaded to and subsequently downloaded from, it is possible (if not likely) that at some point it will be detected by a port scanner and someone will use it to transfer MP3s or warez. When they do this, they will create a funky directory path to make it harder to remove. One of the entries will invariably be similar to the name of one of Windows' named pipes; COM1, LPT1, et cetera. There are generally also directories with spaces on the ends of them.

This kind of "tagging" can happen to FTP sites on other operating systems, but Windows is the only one I'm aware of which has named pipes which are reserved filenames. On Unix-based systems, just remove the directories normally.

The names with spaces on the ends will fall to deletion from the Windows Explorer readily enough, but the names similar to named pipes are the really tricky part. You cannot delete or rename them or anything below them in the directory structure from explorer. In other words, if you have

c:\inetpub\ftproot\tagged by\com1000\for all users \

And note the space at the end of the last dir, please -- You will not be able to delete any of those directories. "tagged by" cannot be deleted because it is not empty, and "for all users " cannot be deleted because it is inside a directory whose path is invalid.

The solution is to use DIR /X in the Windows NT Command-Line Shell (CMD.EXE) to get the DOS equivalent filenames of each directory. For instance, com1000 might turn out to be "COM100~1 ", and for all users would almost certainly be "FORALL~1 ". So simply CD into the dos equivalent filename for the invalid directory and rmdir the dos equivalent of the directories it contains. Then CD to the parent (..) and rmdir its DOS equivalent filename. (In this example, rmdir COM100~1.)

This trick is also necessary for deleting directories with spaces at their ends from the CLI shell. This method will work at least for Windows 2000 and Windows XP, and most likely on Windows NT4.
Click to expand...

Newt · 2005/09/21

Sorry Scott. I have seen a work-around that lets MoveOnBoot delete folders but darned if I can find it when I need it.

The next suggestion I was gonna make is pretty much what is near the end of your quoted section.

Open a cmd window
CD to c:\inetpub\ftproot
Dir /X /A:d
RD /S /Q whatever short file name is shown for the folder

mattymatt79 · 2005/09/21

I dont know if this applies,
but when I had machines that were infected to the brim with spyware / virus and doing a format was not a viable option,

I would boot the machine into either LAS Linux, or Knoppix and mount the hard drive.

We could then go in and delete undeletable by window's files and folders

ed777 · 2005/10/07

Scott Smith said:

Some of you may be familiar with accidentally leaving anonymous log on enabled in ftp and getting your server hacked or tagged by punks.

It was a problem in win2kserver.

I Googled all over the place and have found no clear cut way to remove these folders.
Anyone have any experience with this?
Click to expand...

I have had this very same problem. eventually after reading this thread have deleted the tagged folders using a freeware DOS file manager - DC-SK (DOS Controller- Norton Commander clone). This is available from here: http://short.stop.home.att.net/freesoft/fileman1.htm#fmdos it was able to delete most folders in one hit but some you had to trace the tree right to the bottom to eliminate a protected file.

Hope this helps

Scott Smith · 2005/10/07

Thank you sir I will give it a try.

Log in or Sign up

Removing tagged folders from Inetpub\ftp root

Scott Smith Inactive Alumni Thread Starter

Newt Inactive

Scott Smith Inactive Alumni Thread Starter

Newt Inactive

mattymatt79 Inactive

ed777 Inactive

Scott Smith Inactive Alumni Thread Starter

Share This Page

Log in or Sign up

Removing tagged folders from Inetpub\ftp root

Scott Smith Inactive Alumni Thread Starter

Newt Inactive

Scott Smith Inactive Alumni Thread Starter

Newt Inactive

mattymatt79 Inactive

ed777 Inactive

Scott Smith Inactive Alumni Thread Starter

Share This Page

Useful Searches