finding warez hidden files on hacked machine

[merk]

unfortunately i have a machine thats been hacked. I'm going to wipe it in a few days once i get a replacement machine. But right now on one of my drives there are about 40gb of hidden files. Can anyone tell me how to find them? I dont think they are hidden by simply marking them hidden since i've tried doing attrib -s -h

this is a win2k3 machine.

 

[CTho9305]

http://www.steffengerlach.de/freeware/ Scanner will tell you what directories are using a lot of space. Note that you might have to take ownership of the System Volume Information folder to see if they hid the files in there.

 

[bsobel]

Run SpaceMonger it should give you a pretty good idea where to look...

Bill

 

[merk]

space monger didnt work, and i suspect that scanner wont work either. These files are hidden .. i dont mean they are burried in multiple sub folders or anything like that. They did something to hide the folder. I'll try the scanner since it cant hurt though 😉

 

[bsobel]

Originally posted by: merk
space monger didnt work, and i suspect that scanner wont work either. These files are hidden .. i dont mean they are burried in multiple sub folders or anything like that. They did something to hide the folder. I'll try the scanner since it cant hurt though 😉

Ok, if Spacemonger didn't show it, the directory permissions may have been changed so that your current user account doesn't have rights. Or, there a bunch of NTFS streams on normal files hiding the data.

Bill