[Dshield] I've been hacked

Sat Nov 3 19:14:27 GMT 2001

```Yep-Code Red.  See:
http://www.symantec.com/avcenter/venc/data/codered.removal.tool.html

> DAS wrote:
>
>
> This question has been dicussed and answered here already, but I'm
> still having a problem.
>
> I was also hacked, and the following directory was placed on my
> server:
>
> c:\inetpub\ftproot\0200~\~~tagged and scanned~~\by\com1
>
> I did a DIR /X and the com1 directory name does NOT change.
>
> So I tried the following:
>
> rmdir /s com1
>
> But no matter how I try to delete the com1 directory, I get this
> error:
>
> "The Directory name is invalid"
>
> I don't know what else to try.
>