[cobalt-users] Help suspect haced system

["andy" <andy@xxxxxxxxxxxxxxxxxx>]

Hi all
I think my raq3 may have been hacked:-( However i am not sure how to check
if/what happened. The reason i think the system was hacked is that logcheck
reported a port scan then not long after i had a ftp sesion closed message
from a user not on my system.? That is all i have seen.
How do i look for hidden directories i.e ...
also what anyone else gets if thet do this
 rpm --verify util-linux-2.9o-13rpm

What elso should i look for???

Any suggesations would be great (may help me sleeper better at night)

					Regards Andy
p.s the raq has all the updates installed