Re: [cobalt-users] Raq 3 Problem "Powered by H.U.C(c0011i0n).-----1i0n Crew

["Sam Fareed" <sam@xxxxxxxxxx>]

My concern with the below is that you mentioned applying the updates and modified the index.html only . As many on the list will realize you have encountered the Lion worm.
My understanding is that you would require a server rebuilt and then apply of the patches. I don't know of another way to completely rectify the effects of the Lion worm. Especially the fact that it replaces some services with trojaned ones. Maybe some of the more experienced members on the list with this worm can shed extra light.

More information about the exploit you experienced can be found at http://www.sans.org/y2k/lion.htm

Cheers..../Sam F.


*********** REPLY SEPARATOR  ***********

On 04/05/2001 at 12:24 PM Kime Ne!!! wrote:

>Hi,
>First time asking question to this list.. Nearly 4 weeks ago the team on the
>subject line hacked my raq3 and changed all index.html 's. And I install the
>updates, changed the index.html files and solved this problem. I have nearly
>150 virtual sites and 600 users on my raq3.. My problem is about the users.
>All user have a site as www.domainname.com/~username . And all the have
>index.html too. But No user have a site. The users only use E-Mails. Bu I
>want to change  this index.html But I don't now where is it store? Waiting
>for your helps.
>AdrenalaN
>A______N
>
>_______________________________________________
>cobalt-users mailing list
>cobalt-users@xxxxxxxxxxxxxxx
>To Subscribe or Unsubscribe, please go to:
>http://list.cobalt.com/mailman/listinfo/cobalt-users