Nobody Check Shell Scan Sample: ============================================== In shell with a busy server you won't even notice this: nobody 14064 0.5 0.8 30100 18028 ? S 14:59 0:00 /usr/local/apache/bin/httpd -DSSL nobody 14071 0.6 1.0 32304 20428 ? S 14:59 0:00 /usr/local/apache/bin/httpd -DSSL nobody 14153 19.7 0.1 7400 2976 pts/0 R 14:59 0:10 https nobody 14312 0.3 0.9 30716 18584 ? S 14:59 0:00 /usr/local/apache/bin/httpd -DSSL nobody 14318 0.8 0.9 31136 19032 ? S 14:59 0:00 /usr/local/apache/bin/httpd -DSSL Nobody Check picks it up right away! Put it to work. root@ocean [/tmp]# /usr/local/nobody_check/nobody_check Nobody Check 1.0.3 Current Running on cPanel Copyright (c) 2006 Wave Point Media Inc Made available by www.webhostgear.com Options: kill bad proc=1 logging lvl=1 Initializing Scan on Wed Dec 13 15:00:18 EST 2006 ... httpd is httpd ...clean httpd is httpd ...clean httpd is httpd ...clean httpd is httpd ...clean httpd is httpd ...clean DETECTION: Process 18686 with name perl and path /usr/bin/perl httpd is httpd ...clean Done Scanning DETECTED Malicious Processes: 1 Your servers has found harmful processes - check them right away! A detailed report has been emailed to info@webhostgear.com