how to tell when you have a CRACKER (not hacker)?

[Mike]

I don't really think so but just in case..... well..... my harddrive was 
spinning excessively (I thought). When I checked the process list nothing 
abnormal was running (except ssh-agent) so I shut down and that stopped the 
hard drive.

On Friday 17 February 2006 07:39 pm, Darrin Chandler wrote:
> Mike wrote:
> >how do you do it? I mean, will there be a new process (ps -e) or
> > something?
>
> There may be, or your ps may be compromised and won't show anything
> unusual. There are some rootkit detectors out there, but I can't recall
> them.
>
> First, though: what makes you suspect you have been compromised? If you
> suspect something, the reason you suspect may be the biggest clue.