Re: [gentoo-user] Did I just get hacked???

[Jerry McBride <mcbrides9@comcast.net>]

On Saturday 10 February 2007 09:27:10 pm Grant wrote:
> The contents of my /home/grant/vmware folder have suddenly
> disappeared.  I haven't noticed anything else strange yet.  I did
> configure and start shorewall for the first time yesterday instead of
> using a few iptables commands from the Gentoo Home Router Guide.  I'm
> also running PenguinTV (a video RSS aggregator with an ebuild in
> bugs.gentoo.org) and transmission (a bittorrent client in portage) for
> the first time.  My shorewall config is here:
>
> http://archives.gentoo.org/gentoo-user/msg_108375.xml
>
> What should I do next?
>
> - Grant

1 - if you aren't sure, then take it off the net untill you are sure.
2 - view the log files in /var/log
3 - look at the contents and the file dates... see anything "not rigt"
4 - from a "rescue disk" of some merit  and run chkrootkit or simiar tool.
5 - did/are you running any internet services? Look at their log files with a   
magnifying glass for "any" discrepancy...

--

Jerry McBride
-- 
gentoo-user@gentoo.org mailing list