Is there any source for a VI, VIM, or even EMACS that has all libraries compiled into it statically? That would make monitoring for the rootkit much easier. The same could be said for utilities such as chkrootkit. With compiled in static libraries these level three (user space) rootkits can't edit the results you get, as easily. (Any file system components in user space would also have to be statically linked.) {^_^} Joanne