>Start looking for signs of a compromise / rootkit. That'd be my guess, >based on what I've seen here. Someone's taken control of that box. I'd second that. But if u have a similar machine and ssh is functioning, you could use scp -r to fetch /lib from a known good machine. Regards, D.