<div dir="ltr">Hi Xiscu!<div><br></div><div style>That's not unhide.rb.</div><div style><br></div><div style>Do "apt-get install unhide.rb", then run "unhide.rb".</div><div style><br></div><div style>
Then post the result of that.</div><div style><br></div><div style> Regards //Johan</div><div style><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/1/6 xiscu <span dir="ltr"><<a href="mailto:xiscu@email.de" target="_blank">xiscu@email.de</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'm not sure if I have to forward that to you. Sorry if not!<br>
I got :<br>
<br>
-------------<br>
<br>
Thank you for the additional information you have supplied regarding<br>
this Bug report.<br>
<br>
This is an automatically generated reply to let you know your message<br>
has been received.<br>
<br>
Your message has not been forwarded to the package maintainers or<br>
other interested parties; you should ensure that the developers are<br>
aware of the problem you have entered into the system - preferably<br>
quoting the Bug reference number, #624694.<br>
<br>
If you wish to submit further information on this problem, please<br>
send it <a href="mailto:to624694-quiet@bugs.debian.org" target="_blank">to624694-quiet@bugs.debian.org</a><u></u>.<br>
<br>
Please do not send mail <a href="mailto:toowner@bugs.debian.org" target="_blank">toowner@bugs.debian.org</a> unless you wish<br>
to report a problem with the Bug-tracking system.<br>
<br>
-- 624694: <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624694" target="_blank">http://bugs.debian.org/cgi-<u></u>bin/bugreport.cgi?bug=624694</a> Debian Bug Tracking System Contact <a href="mailto:owner@bugs.debian.org" target="_blank">owner@bugs.debian.org</a> with problems -----------------<br>
<br>
<br>
<br>
-------- Original Message --------<br>
Subject: Bug#624694: Please try unhide.rb<br>
Resent-Date: Sat, 05 Jan 2013 13:45:04 +0000<br>
Resent-From: Debian BTS <<a href="mailto:debbugs@buxtehude.debian.org" target="_blank">debbugs@buxtehude.debian.org</a>><br>
Resent-To: xiscu <<a href="mailto:xiscu@email.de" target="_blank">xiscu@email.de</a>><br>
Date: Sat, 05 Jan 2013 14:43:50 +0100<br>
From: xiscu <<a href="mailto:xiscu@email.de" target="_blank">xiscu@email.de</a>><br>
Reply-To: xiscu <<a href="mailto:xiscu@email.de" target="_blank">xiscu@email.de</a>>, <a href="mailto:624694-quiet@bugs.debian.org" target="_blank">624694-quiet@bugs.debian.org</a><br>
To: <a href="mailto:624694-quiet@bugs.debian.org" target="_blank">624694-quiet@bugs.debian.org</a><br>
CC: <a href="mailto:624694-submitter@bugs.debian.org" target="_blank">624694-submitter@bugs.debian.<u></u>org</a><br>
<br>
<br>
<br>
On 01/04/2013 03:51 PM, Johan Walles wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi!<br>
<br>
Can you please post the output of running unhide.rb on the same system?<br>
<br>
.rb will print the name of any detected hidden processes for you.<br>
<br>
Better diagnostics than the original unhide was among the design goals<br>
for unhide.rb.<br>
<br>
Regards //Johan<br>
<br>
</blockquote>
I'm not sure if that what you mean with 'Unhide.rb' (see below) but the<br>
actual output is:<br>
<br>
===============<br>
# unhide -v sys<br>
Unhide 20110113<br>
<a href="http://www.unhide-forensics.info" target="_blank">http://www.unhide-forensics.<u></u>info</a><br>
[*]Searching for Hidden processes through getpriority() scanning<br>
<br>
[*]Searching for Hidden processes through getpgid() scanning<br>
<br>
[*]Searching for Hidden processes through getsid() scanning<br>
<br>
[*]Searching for Hidden processes through sched_getaffinity() scanning<br>
<br>
[*]Searching for Hidden processes through sched_getparam() scanning<br>
<br>
[*]Searching for Hidden processes through sched_getscheduler() scanning<br>
<br>
[*]Searching for Hidden processes through sched_rr_get_interval() scanning<br>
<br>
[*]Searching for Hidden processes through kill(..,0) scanning<br>
<br>
[*]Searching for Hidden processes through comparison of results of<br>
system calls<br>
<br>
[*]Searching for Hidden processes through sysinfo() scanning<br>
<br>
WARNING : info.procs changed during test : 311 (was 309)<br>
WARNING : info.procs changed during test : 309 (was 311)<br>
HIDDEN Processes Found: 1 sysinfo.procs = 309 ps_count = 311<br>
<br>
===============<br>
# find / -name '*nhide*'<br>
/var/lib/dpkg/info/unhide.<u></u>postinst<br>
/var/lib/dpkg/info/unhide.<u></u>md5sums<br>
/var/lib/dpkg/info/unhide.<u></u>triggers<br>
/var/lib/dpkg/info/unhide.list<br>
/usr/sbin/unhide<br>
/usr/sbin/unhide-tcp<br>
/usr/share/doc/unhide<br>
/usr/share/doc/lm-sensors/<u></u>examples/hotplug/unhide_ICH_<u></u>SMBus<br>
/usr/share/man/man8/unhide.8.<u></u>gz<br>
/usr/share/man/man8/unhide-<u></u>posix.8.gz<br>
/usr/share/man/man8/unhide-<u></u>tcp.8.gz<br>
/usr/share/man/man8/unhide-<u></u>linux26.8.gz<br>
/usr/share/man/es/man8/unhide.<u></u>8.gz<br>
/usr/share/man/fr/man8/unhide.<u></u>8.gz<br>
/usr/share/lintian/overrides/<u></u>unhide<br>
===============<br>
<br>
<br>
</blockquote></div><br></div>