Re: [tlug] Keylogging software

[<stephen@example.com>]

scott writes:

 > Is there a way to detect this process if someone else has installed on
 > your machine? Will top pick it up?

Yes, unless they've also installed a hacked top.  You could try ps,
but they've probably hacked that too.  At this point you could do "cat
/proc/[0-9]*/cmdline | less", but they probably named the process
something like "apache2" and made it suid www-data.  Anyway, your
kernel's also probably been hacked and even /proc doesn't show the
process of that daemon.  Finally, your gcc has been replaced with
dmr-cc[1], so rebuilding from scratch won't help.

Sorry-I-can't-be-more-encouraging-ly y'rs,

Footnotes: 
[1]  Sorry, I don't have the URL offhand.  Dennis Ritchie's truly moby
hack of the Unix C compiler is such a famous story, though, somebody
must have it in their bookmarks.xml.