> But only useful if it is installed from day 1. Otherwise you may be > protecting an already compromised system. Again untrue. Content hashing systems like tripwire really need to be done early if possible but detectors like chkrootkit are like any worm/trojan detector as useful whatever day you install them. Alan
