Re: System compromised --Vanished ?

[Bruce Smith <bruce@xxxxxxxxxxx>]

> I am fairly new to Linux, running RH 6.2 on @home
> network.  Anyway I installed a new soundcard and when
> system powered back up I got some strange boot
> messages.  They went by fast so i couldnt get them all
> but here are a few:
> ..vanish2.tar.gz
> unable to locate /var/logs/httpd/access.log
> unable to locate /var/logs/httpd/errors.log
> -rf user/home/home not found
> your tracks are covered..
> VANISHED ! !
> Eth0 Eth0 in premiscous mode

Doesn't look good!  I recommend you disconnect that box
from the internet while you determine if you've been cracked.
Disconnect so a cracker doesn't use your box to break into 
other sites on the internet and to protect your data.

I think you have some reading to do about security.  There 
are plenty of books and sites on the internet dedicated to
that subject.

> Well anyway did some script kiddie get me? Why
> suddenly does my Eth0 say its in premiscous mode?(and
> what is that).

It means he's probably running a sniffer on your network.

--------------------------------------------
Bruce Smith                bruce@armintl.com
System Administrator / Network Administrator
Armstrong International, Inc.
Three Rivers, Michigan  49093  USA
http://www.armstrong-intl.com/
--------------------------------------------