Re: What kind of process is this ?

[Yago Jesus <yjesus@xxxxxxxxxxxxxxxxxxxxx>]

Im sure:

$ rpm -Vf /bin/ps

and, its ok

2010/1/19 Juan Leaniz <juan.leaniz@xxxxxxxxx>:
> Did you check /bin/ps's timestamp to make sure it wasn't modified or
> replaced? Are you able to see the process if you use lsof ?
>
> On Tue, Jan 19, 2010 at 8:46 PM, Yago Jesus <yjesus@xxxxxxxxxxxxxxxxxxxxx>
> wrote:
>>
>> Hi,
>>
>> Playing with Unhide (http://www.security-projects.com/?Unhide) I have
>> found a very strange process (and I think im not rooted lol).
>>
>> Unhide reports this:
>>
>> Found HIDDEN PID: 24111
>> Command: /usr/lib/opera/operapluginwrapper-ia32-linux
>>
>> Found HIDDEN PID: 24112
>> Command: /usr/lib/opera/operapluginwrapper-ia32-linux
>>
>> Found HIDDEN PID: 24115
>> Command: /usr/lib/opera/operapluginwrapper-ia32-linux
>>
>> Found HIDDEN PID: 24118
>> Command: /usr/lib/opera/operapluginwrapper-ia32-linux
>>
>> Found HIDDEN PID: 24121
>> Command: /usr/lib/opera/operapluginwrapper-ia32-linux
>>
>> Found HIDDEN PID: 24122
>> Command: /usr/lib/opera/operapluginwrapper-ia32-linux
>>
>> If I search -for example- in /proc/24111 directory exists and appears a
>> legitimate process ...
>>
>> But, here is the weird issue, I can´t find it using PS
>>
>> I have tried :
>>
>> #ps -eL | grep 24111
>>
>> #ps axT | grep 24111
>>
>> #ps -aHT | grep 24111
>>
>> I think it is not a 'normal' process, nor a thread, nor a session leader,
>> nor a pgrp ...
>>
>> But, surprise ! , I was able to find it using pstree
>>
>> $ pstree -c -p | grep opera
>>       |-opera(28600)-+-operapluginclea(28937)
>>       |              |-operapluginwrap(30602)
>>       |              |-{opera}(28630)
>>       |              `-{opera}(28873)
>>       |-operapluginwrap(23493)-+-operapluginwrap(24641)
>>       |                        |-{operapluginwrap}(24111)
>>       |                        |-{operapluginwrap}(24112)
>>       |                        |-{operapluginwrap}(24115)
>>       |                        |-{operapluginwrap}(24118)
>>       |                        |-{operapluginwrap}(24121)
>>       |                        `-{operapluginwrap}(24122)
>>
>> More info:
>>
>> $ uname -a
>> Linux centrino 2.6.27.25-78.2.56.fc9.i686.PAE #1 SMP Thu Jun 18
>> 12:36:07 EDT 2009 i686 i686 i386 GNU/Linux
>>
>>
>> $ rpm -qf /bin/ps
>> procps-3.2.7-20.fc9.i386
>>
>>
>> Thanks !
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
>> the body of a message to majordomo@xxxxxxxxxxxxxxx
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html