This has happened only since I changed inetd for xinetd and lsof -i :600 gives me: xinetd 16112 root 6u IPv4 318948149 UDP *:600 which I understand means that xinetd is using port 600. So why should chkrootkit think the port's infected? Barry Samuels http://www.beenthere-donethat.org.uk The Unofficial Guide to Great Britain