chkproc giving false positives for threads?

Hi,

I run the latest chkrootkit/chkproc on my system and it reports 55
processes hidden from ps.

I look in the /proc directory and I don't see any hidden files.

I do a find /proc and grep for the suspicious process numbers, and
they all turn out to be (non-hidden) entries in a subdirectory:

/proc/[number]/task/[suspicious-number]

AFAIK, the "task" subdir is for threads. And, the main process in
question is a Java server process (tomcat) which most likely DOES do
multi-threading.

Could this be an oversight by the authors of chkproc?

.

Quantcast