Re: hidden processes

["Meritt James" <meritt_james () bah com>]

As a couple of untried thoughts, is 'ps' itself corrupted?  Will you get
the reight thing with full-path specification?  And you may want to
(briefly - it is a space hog) turn on process accounting and take a look
at that.

BTW:  What does "hidden from ps" mean?

Jim

Vlady wrote:
> Hi,
> One of my mashines is hacked and chkrootkit-0.40 tells me that I have 3
> proccess hidden from "ps". All of my system binaries looks like beeing clean.
> Using "netstat" I can see that there is not a lisenning servise other than the
> services suppused to work on the machine.
> I know that the best way to go further is to reinstall the machine but first I
> would like to understand more of what have happend.
>
> My question is how can I see this 3 hidden processes.
>
> Cheers
> Vlady
>
> ---------------------------------------------------------------------------
> ----------------------------------------------------------------------------

-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---------------------------------------------------------------------------
----------------------------------------------------------------------------