At last night's happy hour, the subject of root kits came up. Try www.chkrootkit.org. This site is in Brazil, and may be blocked by your firewall. This site has not been updated since 2006. So it may not be up to date. Bug: It looks for lastlog in /var/adm. You may need to make a soft link to /var/log/lastlog. Felix