> Notice the f in place of the date? What does that mean? Perhaps someone has installed a different ls command (and, presumably, others). Try doing "truss ls" to see if it is reading any sort of strange file. Rootkits use to have configuration files hidden in weird places. Borja.