1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Disk space gone/missing

Discussion in 'Plesk for Windows - 8.x and Older' started by ldejager, Feb 3, 2007.

  1. ldejager

    ldejager Guest

    0
     
    Hi,

    We have a Plesk 7.5.6 server running on Windows 2003 which I am experiencing trouble with.

    The server has one physical disk partitioned into two (C/D).

    Partition C is 12GB and D is 124GB

    On partition C the used space is 11GB out of the 12GB. If I select everything on C, it comes to a total of 3.75GB and not 11GB. I also understand there is the pagefile which is at 2GB - not included in above 3.75GB.

    Where is the space going? I checked the volume shadow copy service and it's disabled for both partitions.

    Can anyone perhaps give some ideas as where the space is going to?

    Any pointers much appreciated.
     
  2. ldejager

    ldejager Guest

    0
     
    Right. In folder options enabled view protected system files etc... and on drive C there was a hidden folder called System Volume Information and inside a folder called .tracking. Within that folder there were a few movies uploaded by I dont know who...

    How did someone manage to upload to that directory? How can I track how they managed to get in?

    Any pointers appreciated.
     
  3. sergius

    sergius Golden Pleskian

    28
    57%
    Joined:
    Nov 6, 2005
    Messages:
    1,898
    Likes Received:
    0
    Plesk check C:\WINDOWS\Temp and temporary folders of users profiles.
     
  4. inCharge.co.uk

    inCharge.co.uk Guest

    0
     
    Suddenly missing disk space is a good indication that you've been hacked.

    Your server was probably not adequately protected. You need to enable the firewall, install windows updates regularly, update anti-virus daily automatically.

    There's now no way that you can be sure that you've closed the door on the hacker except by reinstalling Windows.
     
  5. foghead

    foghead Guest

    0
     
    I've also seen this some time ago on a 7.5.6 box. Have a look for something like c:\WINDOWS\system32\wbem\xxxxxx\in\slave.conf (where xxxxxx is the name of the directory containing all your movies). If you find it you'll see the configuration file for this with all the directions for phoning home etc. It's not pretty, time for an OS reinstall for sure.
     
Loading...