I've contacted FDC to see if they can get us the malware off the box, and or any linkages back to motherships. It is still doing SSH scans. -- steve -- Stephen Gill, Chief Scientist, Team Cymru http://www.cymru.com | +1 630 230 5423 | gillsr at cymru.com