I just happened to catch /USR/SBIN/CRON in the output of ps, which strikes me as suspicious because it's in all caps instead of all lowercase. I ran strings over /usr/sbin/cron, and everything looks normal, but I'm wondering whether this is something normal, part of a known rootkit's signature, or something completely weird. -- That's not gibberish... It's Linux. - Byers, The Lone Gunmen Geek Code 3.12: GCS d? s+: a C++ UL++++$ P++>+++ L+++>++++ E- W--(++) N+ o+ !K w--- O M- V? PS+ PE Y+ PGP t 5++ X+ R++ tv+ b+ DI++++ D G e* h r y+