|It turned out that when our machine was attacked, /usr/bin/cp was
|replaced by some other "cp" command which must be grep'ing out few
|files so they do not show up when we do listing.
That is why you need to do a complete reinstall/restore from backup when
a machine is compromised, as attackers will install as many backdoors
and trojan horses as they can to enable them to continue using the
machine even if you patch the security hole they originally exploited.
--
________________________________________________________________________
Working for, but definitely not speaking for, Sun Microsystems, Inc.