RE: [cobalt-users] hacked raq3 Info

[Brent Sims <brent@xxxxxxxxxxx>]

On Sun, 25 Feb 2001, flash22@xxxxxxx wrote:

} > the la.pid contained one line. a number 16459
} > If that's a clue as to their personal identification. Perhaps some
} > of the experts on this list can inform me.
}
} Probably just the process id of some program they were running, should
} have been in /var/run/ , had you done a ps on that number you might have
} gotten the program's full name...

	You're right Flash. I just wanted to add that on the
one server I worked with an la.pid in the root directory I found
seperate and fully functional backdoors had been installed on the
machine. Just a heads up.