[cobalt-users] Been Hacked - WAS: Bad Data in /var/run/utmp

["Craig Napier" <craignapier@xxxxxxxxxxx>]

> When doing a ps-aux, is everything supposed to be listed by PID on RaQ2's? 
> Thanks,
> Charlie
>
> > ps aux sorts first by username, second by PID...

That may be true for an RaQ2 or systems prior to the AMD based systems, but 
not for the RaQ3/4's.. PS will sort (by default) by PID first on RaQ3/4's, 
"NOT" by UserID... That's one tip (sure way of telling) if you've been 
exploited by these recent tool-kits.. Cobalt told me they're not compatiable 
with (their version of) RedHat, and when they upload these "new" files to 
replace the ones already there, it's causing all kinds of system 
strangness.. Also, you might find "syslog.pid" *instead* of  "syslogd.pid" 
under /var/run/ with some of these kits being used..

-Craig Napier

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com