Hey, they finally got my box reloaded... Then I Nmap'd it before I did anything else, and guess what??? I still have 2 NetBus ports and the bo2k port open...

Does this mean that they just reloaded without wiping the drive??? Or are there valid reasons for running services on 12345/6 & 54320??? I read about TrendMicro using 12345 for their virus scanner, but I'm pretty sure this box isn't running that...

Is it possible somebody cracked right back into the fresh box (RH7.3 w/ iptables) in a matter of a few minutes, or is it more likely they just rm -rf /'d it instead of formatting???

I've just started moving some of our accounts off to shared servers w/ another host... Didn't want to do that, but these guys are jackballs...