Taiwan server compromise

[claudiuc () METROPOLIS ESENTIAL RO (Claudiu Costin)]

           Hi all,

   I've noted more AXFR's from a comercial
taiwan site. After nmap scan I found more
services open and especially telnet.
  In few steps using home page email address
(which have same password as login name) I
tried to telnet. Surprise! Even password
wasn't necessary. Looking in /etc/passwd
I found as last line a user (craker :)
account with uid=0.

  What can I do? I don't have experience
with this situations.

P.S. 1) I not tried to "verify" weakness for
rest of accounts, but who know?
     2) I send a mail on "service" account
explaining compromise.

regards,

--
Claudiu COSTIN
<claudiuc () metropolis esential ro>