[cobalt-security] Disk space being eaten up

["Paul Harvey" <paul@xxxxxxxxxxxxx>]

I had a warning e-mail from sys that said I was running out of disk space.
On checking the site usage on the GUI it said that I was using nearly all
the space on the home directory, although if I total up all the sites usage
I get only 507Mb used out of 17Gb total.

On checking the space through Telnet I found a directory called 'cain' that
does not show up on the GUI.  I have deleted this directory and all its
contents.

There is also a file called 'home.tar' this files is 501Mb in size.  Should
I delete this also.  Not sure what it is.

Checking the logs I found a link to the following:
ftp://ftp.technotronic.com/unix/network-sniffers/linsniffer.c
also noticed this link www.hack.co.za

Looks like I have been hacked but I do not know where to go from here.  Any
suggestions?

I have changed the admin password just in case.