that is what I figured. I spent some time trying to identify the rootkit used. I looked at Knark and adore but they didnt seem to match. I do not think I actually found all of the files the hacker had on there but at the time I just wanted to fix it and move on. That is always my reaction fix it and move on. My boss on the other hand likes to try and track hackers down. He tracked one all the way to Isreal. To me that is just a waste of time.

This type of hack job really worries me becasue it is so hard to detect. I would have never thought that someone would hack the kernel. It add a whole new dimention to defending a machine against hackers.