nick zeljkovic kppyozizjtsite5com lsof p pid see located best guess would perl script forking kill find source file remove oddly listed nothing think stdout redirected file would show open file parent init files listed proc process see proc 320 sockets open roger oberholtzer lsof return content reads proc works pids one id suspect root compromise best regards nick zeljkovic thu 07 aug 2008 152336 0100 opensuse system seems hacked