[cobalt-users] raq-3 replacing binaries

[Gerald Young <me@xxxxxxxxxxx>]

hello ater a t0rn attack we have the following binaries that have been changed

/sbin/ifconfig - 18 june
/bin/login - 11 june
/bin/netstat 18 june
/etc/ttyhash - 15 june

does anyone know where i can get the original binaries (running redhat 7
locally) 

also where can i find a log of the logins is there one?
am thinking 
syslog 2 ?

all the best gerald y

-- 
Gerald Young    www.coolcat.net
 www.coolcoach.net - THE HOTTEST WAY TO LEARN -
-------------------------------------------------------------
Localhost: 10:23am  up 14:27,  3 users,  load average: 0.37, 0.10, 0.03
    Server:  5:47pm  up 343 days,  1:09,  1 user,  load average: 0.08, 0.02, 0.01

Word .doc's not accepted and automatically deleted