Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Using Ubuntu 12.04. is there any way to hide a running process ? That process shouldn't' display in system monitor,top,htop . There is no problem to remember the process id (PID) so observation of the process can be done easily .but i want to hide the process completely . is there any way ?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

I would highly recommend you to change the process name and give it some other name so that it might look like you are running some different process.

Example: you can change the process name from "chrome" to "findme".

This can be done programmatically.

or

You can play around at kernel level (pid_getattr) to make it possible. Again this is not recommended.

or

WARNING !!! Don't try the below answer:

If you wanna still go ahead and remove the process from top, there are few softwares which can do that for us. One among those software is called "Rootkits"

Rootkits: When rootkits is installed it overwrites the commands. It can overwrite the command like ps,ls,netstat,find,du,ifconfig,login,killall, etc..

There many malicious software with the same name. So be careful it might infect your system.

Unhide: To detect the hidden process you can use unhide.

share|improve this answer
    
could you provide more about usage on pid_getattr , thank you. –  raaz Sep 1 '12 at 17:25
1  
@GrSr use the book and look at section 10.1.7 Task related information. It might help you to tweak the kernel –  devav2 Sep 1 '12 at 18:14
    
Thank you i will see . –  raaz Sep 2 '12 at 7:20
add comment

It is impossible to hide the process unless one starts messing around in the kernel to limit this.

One technique is to change the process name using:

prctl(PR_SET_NAME, (unsigned long) "NewName", 0, 0, 0);

..and if possible to fork() and let the parent process die. If you were to do that periodically it makes it harder to track down the process.

share|improve this answer
    
nice command thank you .:) –  raaz Sep 1 '12 at 17:23
add comment

You could modify the code of the various process monitors and recompile them. I don't know exactly how process monitors get info about running processes, but I guess they get it from the linux kernel, i.e. if you modify that, it might also work, for any process monitor.

Why exactly do you want to hide the process? Do you want to filter the list of processes (easy with ps+grep commands) or really make it impossible to see it, unless you know the process ID?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.