Trojan Horses Detected by (WHM)

Hidden Pid detected! [pid 6395]
hidden from ps: [yes]
hidden from kernel: [yes]
binary location: [/usr/X11R6/bin/.httpd/init]

and in the current running processes it shows:
/sbin/init (deleted)

a lookup for the suspected trojan Pid 6395 shows:
Process ./init
Owner root
PID 6395
CPU % 0.0
MEM % 0.0
Trace Process Trace
Kill Process Kill
Description The process that spawns all others

help / suggestions

 

 

 

 

Top