On 6:32pm, quoth Mike: =>Hi =>I have a horrible feeling that my system may have been compromised => =>I have a file libwrap.a (part of tcp_wrappers) => =>like this => =>?r-x-wxrwt 26977 25716 159071 1969188457 May 4 2031 =>/usr/lib/libwrap.a => =>(in rescue mode the permissions are Br-x-wrwt) => =>and rpm -V shows =>rpm -V tcp_wrappers =>SM?..UGT /usr/lib/libwrap.a => =>This file cant be deleted. => =>I have replaced all other files directly. => =>So the question is - is it possible to repair this without a full =>re-install? => =>(Running RH9) You could try and make life a bit easier on yourself: rpm -Va check all your running processes and also run chkconfig --list Run lsattr and read the chattr man page. Check out http://www.fiaif.net/ -- -Time flies like the wind. Fruit flies like a banana. Stranger things have - -happened but none stranger than this. Does your driver's license say Organ -Donor?Black holes are where God divided by zero. Listen to me! We are all- -individuals! What if this weren't a hypothetical question? steveo at syslang.net