boricua wrote: >>> Try rkhunter and see! >> Tried it - rkhunter says everything is OK ...mmm... erring to false +ve (Mops >> sweat from brow !) >> > > > how do u know rkhunter was not comprimise > Personally, I install tripwire on all my machines to make sure things like that don't get compromised...