Re: [cobalt-users] kofa\r and kofif\r in base directory.

[flash22@xxxxxxx]

On Fri, 23 Feb 2001, Jim Hagani wrote:

> Hello All.
> 
> I just found these two files in my RAQ3 directory. I know they don't belong
> there.
> 
> I searched the archives and there is one message saying it is a hack. But
> there is no indstructions how to remove it.
> 
> I checked my inetd.conf and that was hacked, so I took the extra lines out.
> There was even a kof.d directory in tmp, which I removed.

Which may have been a mistake, make sure you didn't loose the init scripts
starting your network (inetd) or you will loose telnet after the next
reboot...

> 
> But how do I remove kofa\r ? Whatever I try, I get file does not exist.

rm "kofa\\r"

If you are having this kind of problems, please, seriously consider
finding someone knowledgable in recovering from root compromises...
(no, not me)

gsh