Corrected check_ssh() to exclude /etc/pam.d/sshd. Updated status messages for check_lib and check_ssh() to clarify output *may* indicate attack.