RE: Hacked? Was RE: [cobalt-users] ATT Cable changed email addreses, how to find them?

["Chris Heiner" <cmheiner@xxxxxxx>]

Its @comcast.net, I setup a few today.


POP3 (Incoming Mail) Server: mail.comcast.net 

SMTP (Outgoing Mail) Server: smtp.comcast.net 

Your E-Mail address: e-mail ID@xxxxxxxxxxx
-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx] On Behalf Of agility
Sent: Monday, June 30, 2003 7:08 AM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: Hacked? Was RE: [cobalt-users] ATT Cable changed email addreses,
how to find them?

> On Mon, 30 Jun 2003, agility wrote:
> > I have quite a few site users that could have been AT&T users.
> > Locally that hast changed their email address from someone@xxxxxxxxx
> > to someone@xxxxxxxxxxx
> >
> > Anyone able to tell me where to locate which users have attbi.com
> > addresses so that I can preempt the phone calls of "I'm not getting my
> > email!"
>
>   Scan /etc/virtusertable for attbi
>   Maybe /etc/mail/virtusertable, depends on the version of sendmail.
>
> RaQ2 Shell tools:
> ftp://ftp-eng.cobalt.com/pub/users/jeffb/shell-tools/RaQ2-shell-to
> ols-1.1-2.noarch.rpm

Oh Crunch, not a good sign!
My virtusertable contains a lot of entries that I'm sure should not be
there.
such as
MAILER-DAEMON@xxxxxxxxxxxxxxxx
root@xxxxxxxxxxxxxxxx
sys@xxxxxxxxxxxxxxxx
postmaster@xxxxxxxxxxxxxxxx

there are a load of these type of entry in my Virtusertable for several
sites.

are my worst fears correct, I've been hacked big time?

Paul ASI.


_____________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users