>Uh... Why? Wouldn't it be simpler to just shut down the ftp service >(either /etc/init.d/ftpd stop or comment it out in inetd.conf and then >/etc/init.d/inetd restart), work on it, and restart the service? Because being a trojan it respawns every time you stop it. Otherwise it would be a rather pointless waste of some crackers time wouldn't it? -- Patrick "No sig in my .sig" Kirk GSM: +44 7876 560 646 ICQ: 42219699