RE: [cobalt-users] Hacked Raq3

["Benjamin Charles Tehan" <sysadmin@xxxxxxxxxxxx>]

On a note to my last email

There are a few directories to look for. * means i cant recall

/usr/src/.puta
/dev/.lib/
/usr/info/*/shrs
/tmp

Goto http://www.cert.org/incident_notes/IN-2000-10.html for more
information.

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Mark Brown
Sent: Tuesday, April 03, 2001 11:44 AM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: [cobalt-users] Hacked Raq3


Hello all,

I have a Raq 3 which was recently hacked by someone in China. Basically they
went in and replaced all of my index.html files with their own. I know I
should do a complete rebuild of the server and plan to this weekend but for
now I have uploaded all of my sites again. The only problem is that this
hack also effected and replaced the main admin html for the GUI. Is their
anyone who can tell me:

A. WHere I can get a copy of the default html fiile for the admin sections
on the gui.

B. Whwere this file would go on the system.

Thanks
Mark