Re: hidden processes

As a couple of untried thoughts, is 'ps' itself corrupted? Will you get the reight thing with full-path specification? And you may want to (briefly - it is a space hog) turn on process accounting and take a look at that.

BTW: What does "hidden from ps" mean?

Jim

Vlady wrote:
>
> Hi,
> One of my mashines is hacked and chkrootkit-0.40 tells me that I have 3

-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---------------------------------------------------------------------------
----------------------------------------------------------------------------