JSI Tip 7894. New folders appear that do not belong in your FTP file structure, and you cannot delete them?

When you attempt to delete these new folders from your FTP site, using Windows Explorer, you receive:

Access is denied
Cannot delete
Cannot read from the source file or disk

When you attempt to use the RD command to remove the folder(s), you receive:

The system cannot find the file specified.

When you try to view the Properties of these folders, the Security tab is missing.

These new folders have names similar to:

Com1
Lpt1
Con
PRN

This behavior is generally the result of a malicious attacker altering your FTP site.

To give yourself a good chance of recovering from this attack:

01. Use your favorite backup program to backup the FTP folder structure. If you don't have a backup device, use NTBackup.exe to back up to a file. Make sure you have a working backup before you proceed.

02. Close all Windows Explorer and CMD.EXE windows.

03. Open the Add / Remove Programs applet in Control Panel.

04. Open the Add / Remove Windows Components applet.

05. Select Internet Information Services and press the Details button.

06. Clear the File Transfer Protocol (FTP) Server box and press OK.

07. Press Next and Finish.

08. Open a CMD.EXE window.

09. Using the technique from tip 0167, type RmDir \.C:Inetpubftproot /s and press Enter. Alter the path to your if it is NOT in the default location.

10. Respond Y to confirm the deletion.

11. Open the Add / Remove Programs applet in Control Panel.

12. Open the Add / Remove Windows Components applet.

13. Select Internet Information Services and press the Details button.

14. Check the File Transfer Protocol (FTP) Server box and press OK.

15. Press Next and Finish.

16. Configure your restore process to restore the FTP folder structure, without restoring the hacked (new) folders.