Slide 4 of 21
Notes:
This is the first part of the substitute web page. Evidence was that the file had been created directly via the statd vulnerability, as it had a uid of root.
As you can see, it had been quite closely modelled on the original; however, the replacement was quite a bit longer, with a fair bit of text, and various errors in the spelling and grammar were suggestive (as DJM was first to point out) that the author might be a Francophone.