I found a bogus binary in my (obviously) hacked system in /usr/sbin. I am still investigating. FWIW, it was 608828 bytes big. It appears to have arrived recently, but I haven't determined how. Here is some more info... sum /usr/sbin/asterisk.suspect 15139 595 I'm just posting this in case it's helpful to anyone. The only reason I noticed this is that asterisk stopped working properly.