Its means that you have an rootkit installed and it is hidding some process. Its doesnt mean that your ps or netstat has been trojaned...
Dbc >On Thu, 2003-07-31 at 09:18, Meritt James wrote: > As a couple of untried thoughts, is 'ps' itself corrupted? Will you get > the reight thing with full-path specification? And you may want to > (briefly - it is a space hog) turn on process accounting and take a look > at that. > > BTW: What does "hidden from ps" mean? > > Jim > > Vlady wrote: > > > > Hi, > > One of my mashines is hacked and chkrootkit-0.40 tells me that I have 3 > > proccess hidden from "ps". All of my system binaries looks like beeing clean. > > Using "netstat" I can see that there is not a lisenning servise other than the > > services suppused to work on the machine. > > I know that the best way to go further is to reinstall the machine but first I > > would like to understand more of what have happend. > > > > My question is how can I see this 3 hidden processes. > > > > Cheers > > Vlady > > > > --------------------------------------------------------------------------- > > ---------------------------------------------------------------------------- > > -- > James W. Meritt CISSP, CISA > Booz | Allen | Hamilton > phone: (410) 684-6566 > > --------------------------------------------------------------------------- > ---------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------------------------------
