Strange FTP 'virus'

[jcottrell]

I recently set up an FTP site on IIS and allowed anonymous logins. Well, some Bozo left a bunch of folders (850 to be exact) that Windows won't allow me to delete ("Cannot delete file: Cannot read from source or disk"). One of the folders spells out "con.Tagged by D Syndicate" (using different characters) and many are named "{}{}{}{}{}{}{}".

So here are my questions:

1) What is this?
2) How can I get rid of all of these folders?
3) How can I prevent this from happening again? (Is it enough just to assign user names and passwords?)
4) Is there any damage to my O/S or files outside the FTP root?

JC

[Shawn N]

I have the same problem: folders that I cannot delete no matter what. Think you could let me know if you find a solution for this outside of the forums?

[Evil_Cowgod]

I think if you set the permissions on your FTP server properly people wont be able to do this. Its annoying when people do stuff like that

[Shawn N]

Only permission that has to be given is users being able to create folders. I'm sure the exploit has something to do with the characters used to name the folders.

If kids would realize that this kind of stuff is not at all impressive, THEN maybe it would stop.

[scr0p]

Well, In the warez scene, people upload files to public FTPs, and theyre are people called deleters. They go around public FTP's deleting files because they dont want people to get free stuff (example would be someone on 56K who is mad because he cant download). And someone found a trick to make it so the files can not be deleted. I think its like if you put a slash somewhere in the file. It is not a virus, and I think you can delete them from dos, but I dont know.

[scr0p]

Check this out:
http://www.geocities.com/hardcore18/ftp_deleters.html

[jcottrell]

Yeah, it looks like someone who knew how to lock down the files left a bunch on my FTP directory. I've tried every trick in the book to delete the folders but to no avail. I suppose FDISK/FORMAT will take care of it but that's a huge pain.

I've lifted anonymous login privileges from my site. It's a sad state of things when you can't offer the Internet community a way to access files anonymously. You try to do something nice for people and you get hacked...