<i>"Let's execute command 382 to see what it does."</i><p>Oy. Not the best idea, generally speaking.<p>Edit: I used to read the localized paper version of <a href="http://xakep.ru/" rel="nofollow">http://xakep.ru/</a> several years ago, and practically every hacking story/tool roundup they had mentioned the annoying problem with ls --color, it was apparently present in almost every public rootkit at the time. It's kinda interesting to see that idiots still use outdated tools years later.