.bash_history.clean

Hi,

I'm finding that a user on one of our machines has used something to delete 
their .bash_history file. Whatever they used has gotten past the root perms 
on the file and turned the file into a directory which contains 
another  file called .bash_history.clean

Has anyone seen this before, and perhaps know what I can look for to detect 
the presence of this type of script, or attack. Any info would be appreciated.

Thanks in advance,

Jim 

HWG: hwg-servers mailing list archives, maintained by Webmasters @ IWA