RE: [cobalt-users] Howto trace hack (was: Raq550: SMTP shutting down)

["Crocket" <crocket@xxxxxxxxxxx>]

> While I still don't believe in leaving a compromised machine online, and
> I heartily recommend a complete rebuild, whether or not you do said
> rebuild, yes it could happen again.

I know ... but they never had shell access and according to the logs they
used the /tmp/ the first time and /var/spool/samba the second time.
The gallery module they used has been removed from the 2 sites.
I also keep monitoring the processes and nothing unusual is popping up ...

> I'd recommend setting permissions on gcc so it will only work for root.
I already did that once I knew what they had done ;-)