Re: [cobalt-users] Hacked?? Help!!

["John D. Gorena" <Support@xxxxxxxxxxxxxxxxxxx>]

Wayne,

We had the same problem and it came from a security hole on the RAQ3 updates.
They have since fixed the problem and you may wish to update your server.

I deleted the temporary files and files that were in my root directory that were
new and strange - they were dated about the same time as the temporary files.
Be carefull not to delete what is needed.    I updated the security patches and
rebooted.  No problems since.

If you are using a RAQ3 then goto
http://www.cobalt.com/support/download/raq3.eng.html.  Otherwise, goto
http://www.cobalt.com/support/download/ and pick your server type.


--
John D. Gorena
PC and Internet Marketing Consultant
http://www.JMG-Enterprises.com
Office: 972-315-0496
Fax: 972-315-3104



Wayne Sagar wrote:

> As mentioned in my last message, I noticed a telnet connection when doing a
> netstat.. doing a netstat -l brings me the "normal" listening stuff httpd
> and the mails stuff and the legato backup stuff.. this one worries me..
>
> Active UNIX domain sockets (only servers)
> Proto RefCnt Flags       Type       State         I-Node Path
> unix  0      [ ACC ]     STREAM     LISTENING     295    /tmp/.s.PGSQL.5583
>
> The /tmp/.s.PGSQL.5583 is an empty file sitting in the tmp directory and it
> was created at about the same time I noticed the telnet log in (if you have
> not read he previous message, telnet is turned off on this server) and I
> have never installed SQL on this machine..
>
> Is this someone who has installed a program set to listen to the activity
> on my machine and then have it mailed off to them?
>
> It never ends... 6 hours watching this making zero money neglecting
> business that could be making me money...
>
> Any advise will be greatly appreciated... I tried to research the list
> archives and google on this but no links on the cobalt system were working
> when I tried.. soo... be kind.
>
> Wayne
> Wayne Sagar
> Airport Fence Productions, Inc.
> http://airportfence.com
> All Aviation FlightLine OnLine
> http://aafo.com
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users