RE: [cobalt-users] hacked raq3 Info

["Lennie Core" <lcore@xxxxxxxx>]

Well they got me too !

I did notice just before we pulled the plug that there was an la.pid 
file in my root.

also during the restoring from individual site backups, we noticed
most of the sites ownerships were changed to numbers like 
149:site# and 239:site#..

the la.pid contained one line. a number 16459

If that's a clue as to their personal identification. Perhaps some
of the experts on this list can inform me.

Other than that I found a chkroot kit installed. I never did it. And I 
suppose perhaps Cobalt did one time during a tech support 
session.

Anyways, wiped it all out did the restore CD thing and all the 
current updates. So far 3 days and running. 

Disabled Telnet... Put up ssh and only open ftp on request..

She's locked down..

Cheers, Lennie Core