Test with Chkrootkit

[Michael Schwendt]

On Mon, 26 Jul 2004 19:32:24 -0700, Norman Nunn wrote:

> This is a second response to Geoffrey message below.
> 
> Here is the output from the two operations below.  I ran the "cat
> /proc/<pid>/cmdline" on a sample of the pid's.  They tend to repeat as
> long as the pid sequence does not have holes.
> 
> ****start of terminal printout*****
> 
> [user at localhost user]$ chkproc -v
> PID  5529: not in readdir output
> PID  5529: not in ps output
> PID  5532: not in readdir output
> PID  5532: not in ps output
-snip
> You have    17 process hidden for readdir command
> You have    17 process hidden for ps command
> 
> [user at localhost user]$ cat /proc/5529/cmdline
> 
> nautilus--no-default-window--sm-client-iddefault3

> Is that what should be expected??

Yes, Nautilus, Evolution, GNOME and friends show up there.