Re: [ALUG] What to do after being hacked?

The 'standard' tool for comparing a filesystem that has possibly been interfered with against a one known to be valid (e.g., on CD-ROM) is Tripwire; however, many find it difficult to configure. I normally use a fairly short Perl script that does a similar job -- google for "file system saint" and you'll find it. HTH. ..Adrian -- Dr Adrian F Clark WEB: http://privatewww.essex.ac.uk/~alien/ EMAIL: alien/at/essex.ac.uk TEL: +44 1206 872432 FAX: +44 1206 872900 PAPER: VASE Lab, Dept CES, University of Essex, Colchester, CO4 3SQ,UK "The great tragedy of science: the slaying of a beautiful hypothesis by an ugly fact" -- Huxley