RE: [cobalt-users] B**tards!

["First Hosting Sales" <sales@xxxxxxxxxxxxxxxxxx>]

> ----- Original Message -----
> Subject: RE: [cobalt-users] B**tards!
> 
> 
> > Why today.  I have just got back from my father's funeral and some 
> > complete bastard is hacked into my machine.  Someone is using my 
> > server to send spam. I suspect through the old formmail 
> exploit.  I've 
> > just suspended the site in question.
> 
> > Did you setup chkrootkit or any other binary file size check tool?
> 
> This will help answer the *hack3d* question but if it is the 
> 'ole formmail exploit, you may not be hack3d.  Their just 
> using the script to send mail.  As root, type: locate 
> formmail (there is a formail on the server so make sure to 
> spell formmail, with two m's)
> 
> Should tell you where it is, delete it...

This might be true for Andy, but other users should be careful as the
soundforge script is also called formmail.

Just worth mentioning.

Ian