try a dd if=/dev/zero of=/<file path and name> bs=1024 count=1024 this _should_ overwrite the file(s) for 1M with 0s. Also check selinux status with ls -laZ and see if selinux got turned on or changed 'getenforce' to show, 'setenforce [01]' to temp change. <div class="gmail_quote">On Mon, Mar 19, 2012 at 7:29 PM, Barry R Cisna <<a href="mailto:brcisna@eazylivin.net">brcisna@eazylivin.net</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hello, thanks for the additional suggestions. Yes. I have run rkhunter,,and rkhunter does in fact show that this machine has hanged with shv4. Also i did boot up one more time with the deft live cd to double check the lsattr of each of the two directories,,and neither dir shows the immutable bit is set on the dir,,or any of the files that will not delete? Also for completeness I did not mention previously I did copy known good binaries from a good server to replace the (about a dozen binaries) that was replaced by shv4 kit. I could tell fairly easily as the replaced binaries had a user of 114 and group of 112. The machine does not really show any odd processes,,or netstat stuff running,,,but Id simply like to figure out why these files will not delete. Thanks again, Barry <div class="HOEnZb"><div class="h5"> _______________________________________________ K12OSN mailing list <a href="mailto:K12OSN@redhat.com">K12OSN@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/k12osn" target="_blank">https://www.redhat.com/mailman/listinfo/k12osn</a> For more info see <<a href="http://www.k12os.org" target="_blank">http://www.k12os.org</a>> </div></div></blockquote></div> -- -- James P. Kinney III As long as the general population is passive, apathetic, diverted to consumerism or hatred of the vulnerable, then the powerful can do as they please, and those who survive will be left to contemplate the outcome. - 2011 Noam Chomsky <a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a>