Hello, I am getting reports from one box recently loaded with Debian Sarge /etc/cron.daily/chkrootkit: INFECTED (PORTS: 600) but I found some emails through Google that suggest false positives identical to this. Any suggestions please? -- Chris Bell -- Gllug mailing list - Gllug at gllug.org.uk http://lists.gllug.org.uk/mailman/listinfo/gllug