> If you were using an RPM based distro, you could do "rpm -Vf /bin/ps" to > see if the various attributes have changed since installation. I've no > idea how to do that using apt, though. If you system uses prelink its likely to have fiddled with the binaries which make the rpm checks a bit useless these days. ChrisB.