On Mon, 12 Apr 2004, David Corbin wrote: > And is there anyway to detect these? > > chkrootkit hasn't found anything.... chkrootkit will find many of them.... On your system, do you have /dev/shm mounted in /etc/fstab? What happens if you comment it out and reboot? later, chris