Hey Claymore,

Discovered a disturbing issue with one of my machines. It has happened twice now - at first I thought it was a glitch.
My config file appears to have been over-written remotely - only the t address has been replaced to allow mining to a different address.
I don't believe that is your development fee ;-)

Here is the address in question on http://zcash.flypool.org/: t1LkBCiHBkoKocxEDrQXTnhWo1TuhVhys9J

Only one of my systems is exposed and the issue (exploit?) has happened on that one only.

From the log:

23:45:58:250   20d0   Remote management: file config.txt was downloaded
23:45:58:250   20d0   srv bs: 0
23:45:58:250   20d0   sent: 40

...

23:46:00:849   2528   recv: 50
23:46:00:849   2528   srv pck: 49
23:46:00:865   2528   Remote management required restart

...

23:46:01:917   2528   Restarting OK, exit...

Do we have a sneaky attacker using a way to mine for himself /herself ?

Tell me I am not going crazy here. I need to secure it.