this took a long time to find it on the net.
------------------ search result----------------
> > Can't find what's creating a root process showing instead of its
> > name a smiley :-0, when doing a ps aux ?!? Everytime I kill it comes
> > back almost instanteneously. Anybody having seen this? Log files 9as
> > much as I know what to look for) don't give me a hint. There is no
> > parent showing for it either.
> > Is there a facility in Linux where I can trace all forked processes,
> > so that I can (perhaps) trap this guy upon creation, after I kill its
> > previous instance?
>
> Looks like you've been hacked. Somebody has played a nasty joke
>
> As for why you can't kill the process chances are it's continually
> forking new copies of itself and deleteing the old copy.
--------------------------------snip---------------------------
There seems to have been such a discussion on this list itself but cant
seem to find it. But from the above thread, was able to resolve my
question. It is the work of [kgx]dm. Below is the relevant man page. Which
indded makes me feel sheepish.
-------------------------------------------------
Xdm attempts to mark its various sub-processes for ps(1)
by editing the command line argument list in place.
Because xdm can't allocate additional space for this task,
it is useful to start xdm with a reasonably long command
line (using the full path name should be enough). Each
process which is servicing a display is marked -display.
in other words "-:0"
---------------------------------------------
But one thing is stiil not resolved. Why is kdm spawning 2 copies of
itself on my box, apart from the -:0. Whichever one i kill, gets me back
to the login screen. Have to check up on the prefdm script.
But please, if anyone is having the same ie "ps aux| grep kdm"
returning 2 instances please confirm that. I am in doubt whether that is a
regular/normal occurence
thanks
sreangsu
----------------------------------------------
An alpha version of a web based tool to manage
your subscription with this mailing list is at
http://lists.linux-india.org/cgi-bin/mj_wwwusr
