Using Ubuntu 12.04. is there any way to hide a running process ? That process shouldn't' display in system monitor,top,htop . There is no problem to remember the process id (PID) so observation of the process can be done easily .but i want to hide the process completely . is there any way ?
Add a comment
|
3 Answers
It is impossible to hide the process unless one starts messing around in the kernel to limit this.
One technique is to change the process name using:
prctl(PR_SET_NAME, (unsigned long) "NewName", 0, 0, 0);
..and if possible to fork() and let the parent process die. If you were to do that periodically it makes it harder to track down the process.
answered Sep 1, 2012 at 13:35
I would highly recommend you to change the process name and give it some other name so that it might look like you are running some different process.
Example: you can change the process name from "chrome" to "findme".
This can be done programmatically.
or
You can play around at kernel level (pid_getattr) to make it possible. Again this is not recommended.
or
WARNING !!! Don't try the below answer:
If you wanna still go ahead and remove the process from top, there are few softwares which can do that for us. One among those software is called "Rootkits"
Rootkits: When rootkits is installed it overwrites the commands. It can overwrite the command like ps,ls,netstat,find,du,ifconfig,login,killall, etc..
There many malicious software with the same name. So be careful it might infect your system.
Unhide: To detect the hidden process you can use unhide.
-
-
1
You could modify the code of the various process monitors and recompile them. I don't know exactly how process monitors get info about running processes, but I guess they get it from the linux kernel, i.e. if you modify that, it might also work, for any process monitor.
Why exactly do you want to hide the process? Do you want to filter the list of processes (easy with ps+grep commands) or really make it impossible to see it, unless you know the process ID?
