As a couple of untried thoughts, is 'ps' itself corrupted? Will you get the reight thing with full-path specification? And you may want to (briefly - it is a space hog) turn on process accounting and take a look at that.
BTW: What does "hidden from ps" mean? Jim Vlady wrote: > > Hi, > One of my mashines is hacked and chkrootkit-0.40 tells me that I have 3 > proccess hidden from "ps". All of my system binaries looks like beeing clean. > Using "netstat" I can see that there is not a lisenning servise other than the > services suppused to work on the machine. > I know that the best way to go further is to reinstall the machine but first I > would like to understand more of what have happend. > > My question is how can I see this 3 hidden processes. > > Cheers > Vlady > > --------------------------------------------------------------------------- > ---------------------------------------------------------------------------- -- James W. Meritt CISSP, CISA Booz | Allen | Hamilton phone: (410) 684-6566 --------------------------------------------------------------------------- ----------------------------------------------------------------------------
