Disk space gone/missing

[ldejager]

Hi,

We have a Plesk 7.5.6 server running on Windows 2003 which I am experiencing trouble with.

The server has one physical disk partitioned into two (C/D).

Partition C is 12GB and D is 124GB

On partition C the used space is 11GB out of the 12GB. If I select everything on C, it comes to a total of 3.75GB and not 11GB. I also understand there is the pagefile which is at 2GB - not included in above 3.75GB.

Where is the space going? I checked the volume shadow copy service and it's disabled for both partitions.

Can anyone perhaps give some ideas as where the space is going to?

Any pointers much appreciated.

 

[ldejager]

Right. In folder options enabled view protected system files etc... and on drive C there was a hidden folder called System Volume Information and inside a folder called .tracking. Within that folder there were a few movies uploaded by I dont know who...

How did someone manage to upload to that directory? How can I track how they managed to get in?

Any pointers appreciated.

 

[sergius]

Plesk check C:\WINDOWS\Temp and temporary folders of users profiles.

 

[inCharge.co.uk]

Suddenly missing disk space is a good indication that you've been hacked.

Your server was probably not adequately protected. You need to enable the firewall, install windows updates regularly, update anti-virus daily automatically.

There's now no way that you can be sure that you've closed the door on the hacker except by reinstalling Windows.

 

[foghead]

I've also seen this some time ago on a 7.5.6 box. Have a look for something like c:\WINDOWS\system32\wbem\xxxxxx\in\slave.conf (where xxxxxx is the name of the directory containing all your movies). If you find it you'll see the configuration file for this with all the directions for phoning home etc. It's not pretty, time for an OS reinstall for sure.