I got the above message last night from chkrootkit. I haven't touched my /root/.bash_history. Are there any programs that modify this? There's no other evidence of a break-in. I've confirmed that this file has zero size: # cd debian:~# ls -l .bash_history -rw------- 1 root root 0 Oct 28 08:03 .bash_history What do you suggest that I do?