Re: [cobalt-security] I've been hacked -- now what do I do?

[Gossi The Dog <gossi@xxxxxxxxxxxxxx>]

On Mon, 6 Nov 2000, Chris Maxwell, WDSL Inc. wrote:

> Hello Steve,
>
> Why don't you just go into the /etc/rc#.d directories, and run
>
> grep nothing * |more

It might be started elsewhere though, remember.

Probably worth doing locate nothing, finding the binary, running "strings"
on it and generally seeing if it looks sus.

All the Cobalt RPMS are available from ftp.cobaltnet.com (which is running
exploitable proftpd I might mention, as is ftp.cobalt.com, and the rest of
the Cobalt network), if you want to reinstall the key system compontents.
You'll need to reapply the OS3 update and security updates afterwords,
however.