On Fri, 2005-09-09 at 10:06, Jose Luis Hime wrote: > chkrootkit and rkhunter do not report any problem. > > I am still with this issue, any hints? > How many people have access to root? Assume you have changed the root password as well as checked the /etc/passwd and /etc/shadow files for any odd entries. What permissions does the /etc/shadow file have? You should also check all cron jobs to see if someone set something up there. Last resort is to do a complete bare metal install again and keep root password to yourself.
