On 02/07/11 10:06 AM, Nicolas Ross wrote: > I found some suspicious file in /bin and /usr/bin directories that are owned > by user id 122, where this machine doesn't a userid 122. > oh. get and run rkhunter. preferably do it on read only media via another system.