Hi! Maybe, you should scan your /etc/passwd for a user called "Malk" and/or "Malk2" which has uid:gid 0:0 but no password! I found this user on four independent systems I'm managing. It came along with a new directory inside /dev which contained some tools to hack the system, hide tasks/files in ps/ls and some more! bye, Sebastian