Re: [OT] Rootkit queston

From: Måns Rullgård
Date: Mon Dec 01 2003 - 18:36:56 EST

"Richard B. Johnson" <root@xxxxxxxxxxxxxxxxxx> writes:

>> They seem to have PID 0, is this normal?
> Yes. These are kernel threads.

That doesn't necessarily rule out the possibility of them being evil.
If someone has taken control of the system, he could have loaded some
module that started a thread disguising itself under a common name.

Måns Rullgård

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at