[cobalt-users] (no subject)

["Jamie" <jamiem@xxxxxxx>]

Hello List,

Ok, I have found an odd occurence in our RaQ4r..

On one of our websites there is a directory:

<SNIP - WORD WRAPPED - it's all one line>
"/home/sites/site1/web/cons/working/desktop/
desktop/desktop/desktop/desktop/desktop/
desktop/desktop/desktop/desktop/desktop/
desktop/desktop/desktop/desktop/desktop/
desktop/desktop/desktop/desktop/desktop/
desktop/desktop/desktop/desktop/desktop/
desktop/desktop/desktop/desktop/desktop/
desktop/desktop/desktop/desktop/desktop/desktop/"
</SNIP>

Also, the file "gmon.out" it located throughout the site now.  Only the
site, nowhere else on the box..
When I do a "locate gmon" it lists several files in that last "desktop"
directory.  However, when I change to that directory, it is empty..
Nothing..  Nadda..  Zip..  Zero..  Zilch..

Umm, not sure what it can be yet, I am assuming it's one of my co-workers
ftp'ing something and not realizing it..  But they both swear up and down
that they didn't do it, and they don't know how it got there..  But since I
am out of the office today, I can't check their computers until tomorrow...

I do not believe I have been hacked, but I am unsure..  I am still a newbie
after all..  I checked "last" and I checked the logs..  All seems in order..
I checked the time of the files against the time of log-ins and ftp's..  I
did notice that the site admin had logged in at the same time, but only to
ftp..  And also no sign of any of these files in the ftp logs...

I am at a loss..  I do not know what else to do..  Anyone have any ideas??

Thanks List!

-Jamie-
http://w-c.net
WebConnection.Net, Inc.
In a mad world, only the mad are sane...