I hope this is the right place for this, but here goes.

One of my clients (that don't give two hoots about upgrading and patching... go figure) got cracked. I know this because when you type #init 6 you get:

>
[root@xxxxxx mail]# init 6
_ __/|
\~x.X' world for sonhonhocas crew
=(___)=
U bambulua house


*****: Got signal 11 while manipulating kernel!
>
* was not a *

Can anyone tell me how I could fing out more about what this person did. He/She covered it's tracks in the logs quite well.

Thank you,

./GPF