On Sun, Sep 14, 2014, Always Learning wrote: > >Thank you to Steven and to Valeri for an excellent idea. > >The fsck cured the problem. The problem files were removed by fsck >during its recovery/rectification. The first thing you should do when you find files or directories is use 'lsattr' to check the attributes. In particular look for the 'i' attribute which marks the entry as immutable. A favorite trick of crackers is to put their own versions of commands such as /bin/ps, /bin/ls, /usr/bin/find, etc. to hide their activity. You can use the 'chattr' command to change the attributes with something like 'chattr -i /bin/ps' to remove immutable attribute. If there are multiple attributes shown by the 'lsattr' command, simply add them like 'chattr -iAs /bin/ps'. It also takes the -R option to run recursively through a directory. Bill -- INTERNET: bill at celestial.com Bill Campbell; Celestial Software LLC URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way Voice: (206) 236-1676 Mercer Island, WA 98040-0820 Fax: (206) 232-9186 Skype: jwccsllc (206) 855-5792 The government is like a baby's alimentary canal, with a happy appetite at one end and no responsibility at the other. -- Ronald Reagan