There must be a backdoor or weakness in SMOS because my cgminer config got changed.... My Guess its the web part that has the weakness because my passwords was not changed and there was online change of cgminer config in syslog.