16 Dec
2007
16 Dec
'07
6:47 p.m.
On Sun, 2007-12-16 at 08:33 -0800, wa6fwf wrote:
it looks fine here, maybe they have already fixed it or if you checkagain and it still looks hacked your pc may have been compromised and your being redirected to different sites...
It had been hacked, along with a few other virtual servers on the same system. I restored them all from a backup and did a bit of digging around. So far found 1 ircbot and a world-writeable directory. The index.html etc in almost every directory had been got at, even some not in the web directories all of which had a time stamp of 0432-0436 this morning. What med me more suspicious was a reboot at 10:50 yesterday morning, but suddenly remembered that the power was off yesterday around that time and a few other systems in the next office also had a reboot.
Bye for now, John