Wim De Smet wrote: > >A rootkit perhaps. But I'd think that they'd install a modified df and >not bother with the du. > How would you detect one? > Did you run du as root btw? > > yes.