I had posted about this yesterday. I guess it did not went through because
I registered after I posted this message.

I have a Solaris 2.6 standalone workstation. A user trying to connect to it
through SSH and Exceed to use dtmail and dtsession. But one day the
$HOME/.TTauthority file got mysteriously changed to root ownership and
she was denied access of the things she usually do. I had checked the
system logs and were not able to find any trace of an intrusion. Just wonder
if somebody has an idea about what had happened.

Thanks,

Youhua Chen.