On Sun, Oct 26, 2003 at 02:03:36PM +0100, Thomas Wana wrote: > Hi, > > On Sunday 26 October 2003 13:42, Nikolai Buer wrote: > > > > The funny thing is that the PIDs in question here are so low. Moreover, > > they're actually not hidden from ps, just set to 0 (impossible). > > > > Line 1067 skips processes with an PID of 0 from being listed. > But I don't know why your 'ps aux' lists them... perhaps a > bug in the rootkit :-)
But these are PIDs that are normally used by the processes with the same name, they look like normal kernel threads. It could be a bug in the rootkit, but might it not also be a bug in the software? nikolai.
