### Output of: ./chkproc -v -v -p 3
###
PID   482(/proc/482): not in getpriority readdir output
[...]
PID 31564(/proc/31564): not in getpriority readdir output
You have    49 process hidden for readdir command
not found

# ./ossec-rootcheck -c rootcheck.conf

** Starting Rootcheck v0.7 by Daniel B. Cid        **
** http://www.ossec.net/hids/aboutus.php#dev-team  **
** http://www.ossec.net/rootcheck/                 **

Be patient, it may take a few minutes to complete...

[FAILED]: Rootkit 'Showtee' detected by the presence of file '/usr/lib/libfl.so'.

[OK]: No binaries with any trojan detected. Analyzed 57 files

[FAILED]: File '/dev/shm/network/ifstate' present on /dev. Possible hidden file.

[OK]: No problem found on the system. Analyzed 40717 files.

[FAILED]: Process '8329' hidden from ps. Possible trojaned version installed.
[...]
[FAILED]: Excessive number of hidden processes. It maybe a false-positive or something really bad is going on.

[OK]: No kernel-level rootkit hiding any port.
      Netstat is acting correctly. Analyzed 131072 ports.

[OK]: The following ports are open:
      25 (tcp),80 (tcp),3306 (tcp),4949 (tcp),
      12345 (tcp)

[OK]: No problem detected on ifconfig/ifs. Analyzed 3 interfaces.


- Scan completed in 86 seconds.

# /usr/local/sbin/unhide sys        
Unhide 02-11-2007 
yjesus [at] security-projects.com


[*]Searching for Hidden processes through getpriority() scanning

Found HIDDEN PID: 941
[...]
Found HIDDEN PID: 31564
[*]Searching for Hidden processes through getpgid() scanning

[06:54:14] Warning: Hidden processes found:  4309
[..]
 25743
[06:54:14]
[06:54:14]   Performing check of files with suspicious contents

# ./listps -d
Checking pids from 0 to 33000
# /usr/local/sbin/untcp
Unhide 02-11-2007 
yjesus [at] security-projects.com


Starting TCP checking

Starting UDP checking

# ls -d /proc/* | grep [0-9] | wc -l; ps ax | wc -l
25
25
# ls -d /proc/* | grep [0-9] | wc -l; listps |grep [0-9] | wc -l
24
25