[cobalt-users] RE: Help suspect hacked system

[David <david_dean@xxxxxxx>]

>>The reason i think the system was hacked is that logcheck
>>reported a port scan then not long after i had a 
>>ftp sesion closed message from a user not on my system.? 

Chances are you've *not* been hacked (been there).. That ftp session closed
message appears even if they don't get in/succeed at their connect attempt.
*Unless* you've got anonymous FTP enabled on your sites (still slim chance you
were hacked)... If you *do* have anon FTP enabled, and don't really use it..
DISABLE IT!!  

Type in "last" from a command prompt to see a list of all the previous logins
to your machine. If you were hacked, chances are they wiped this file and it
will only go back to the time of the hack... If it's logins only go back a few
hours (not several days/weeks or months), you might have concerns..

Good Luck!
-David

____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1