Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i ran chkroot, rkhunter, and nothing was revealed.

i ran unhide brute,

and it reveals a hidden PID

so i ps aux | grep ^PID

but nothing shows up.

i run unhide brute again, and theres nothing.

i run unhide brute again in a few seconds, and theres a new PID.

what should i do ? should i be concerned... ?

share|improve this question

If this is unhide from 2009-08-10 (BETA), it isn't necessarily any foul play.

A quick look at the source-code of the brute-force-check, there seems to be a race-condition present.

What it looks like is that the brute-force scan will fork processes and try to touch the entire pid space, after it's done with all trying to touch all possible pids, it will then go through the entire list and for each pid it hasn't touched it'll run a ps against that pid and check if it exists. The problem is that there's plenty of time for a legitimate process to exit during the brute-fork scan or during ps'ing other holes in the brute-fork scan, and this will then be listed as hidden.

share|improve this answer
This race condition is a common cause of false positives in tools like chkrootkit. – Zanchey Oct 28 '09 at 11:57

Try using OSSEC rootcheck to test. It is better at detecting rootkits than these two tools. Link:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.