Date:  Thu, 17 Sep 2009 12:10:23 -0700 (PDT)
From:  Dan Kriwitsky <webhosting (at mark) yahoo.com>
Subject:  [coba-e:16047] Re: Phishing Scams
To:  coba-e (at mark) bluequartz.org
Message-Id:  <746461.81263.qm (at mark) web65608.mail.ac4.yahoo.com>
In-Reply-To:  <2EDD87B88A254277AC2D442FF6392589@KenMarcusPC>
X-Mail-Count: 16047


> If root owned the files then you might need to cmu export,
> wipe the server, then re-import to a fresh server.
> 

If the date on the file is correct, zgrep on the access_log for that date might reveal something.

-- 
Dan Kriwitsky