On Thu, Sep 13, 2007, Feizhou wrote:
I have seen vi do this action when it didn't understand a keycode on teh terminal you are using properly... change the case of a few letters next to the cursor. But IIRC that was busybox vi.
Is it crazy to propose someone opened /etc/passwd in vi, and saved it out without noticing this had happened?
If you suspect your box has been rooted, then perhaps it is time to do some checking.
rpm -Va
Unfortunately that isn't much use if you're running the default system with prelink as it changes large numbers of executables rendering the RPM verify close to useless.
Bill -- INTERNET: bill@celestial.com Bill Campbell; Celestial Software LLC URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way FAX: (206) 232-9186 Mercer Island, WA 98040-0820; (206) 236-1676
The very powerful and the very stupid have one thing in common. Instead of altering their views to fit the facts, they alter the facts to fit their views ... which can be very uncomfortable if you happen to be one of the facts that needs altering. -- Doctor Who, "Face of Evil"