You will need to find the point of entry. Without the point of entry you have no way od stopping it.
Mr. Michele Neylon Blacknight Solutions http://www.blacknightsolutions.ie/ http://www.search.ie/ FREE IE domains - see site for details Tel. +353 (0)59 9139897 Fax. +353 (0)59 9139897 > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Pablo Medina > Sent: 04 November 2003 13:10 > To: [EMAIL PROTECTED] > Subject: [cobalt-security] Cobalt Raq 4 Hacked > > Hi all. > Today at 2:00 in the morning our RaQ4 was hacked. > > The hack replaced all files named index.* with own hacker content. > > We have had this issue a couple of weeks ago. That time the > hack afected all index.* files under /home/sites. > > Now the hack affected all index.* files under / so the > Control Panel is affected too. > > I must note a week ago the server wass rebuilded formm > scratch and ALL upgrades were applied. > > I have chkrootkit and portsentry installed. None of those > reported strange activity. > > I have checked open ports in the server and theres' no > strange ports opened. > > I want to know if somebody has experienced the same issue, > and any help will be apreciated.. > > TIA > Pablo > > > > > > > > > > > > > > ------------ > ¡Ayudá a los chicos navegando! > En noviembre, Yahoo! dona un plato de comida por cada usuario > que nevegue gratis con Yahoo! Conexión. > Conectate ya en http://conexion.yahoo.com.ar > _______________________________________________ > cobalt-security mailing list > [EMAIL PROTECTED] > http://list.cobalt.com/mailman/listinfo/cobalt-security > > ######################################################### This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance to it is prohibited. _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
