I'm not trying to imply you didn't check thoroughly because I don't know the whole story and your background. But for me personally I wouldn't take the risk - e

I'm not trying to imply you didn't check thoroughly because I don't know the whole story and your background. But for me personally I wouldn't take the risk - even if the compromised account was 'nobody'. I certainly don't know enough about computer forensics to make sure that a system hasn't been altered (and I dissect malware for recreational purposes). So unless it's a system that hosts something completely unimportant I'd take the weekend free to wipe + reinstall the stuff. Even recently a linux local privilege escalation has been discovered[0]. So who knows what the hacked www user really had access to. [0] http://seclists.org/oss-sec/2014/q2/467 http://seclists.org/oss-sec/2014/q2/467