On Sun, 21 Nov 2004, Ryan O'Rourke wrote: > Sam MacDonald wrote: >> Sounds like you better check to see if you were rooted... > > I was /really/ hoping no one would say that. > uh... Thanks. Sadly, I can tell you that I've had similar experiences. When they break into your system, they'll change the ls and ps binaries so that they don't display certain files or processes that they are trying to hide from you. In my experience, those very attempts to conceal the breakin are sometimes of such poor quality that you detect the bad ls or bad ps binary way before you would have noticed the other stuff they were doing. I keep copies of ls and ps binaries on my system so that I can use them if I think I've been cracked. Mike _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota Help beta test TCLUG's potential new home: http://plone.mn-linux.org Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list