|
Well, the reason they modify ps is so that the daemons they start won't be found through the usual methods. They also modify who and w for similar reasons. Most of the crackers I've found are looking to run irc bots of some sort. They want to start the daemon and leave and not be noticed for a while.
|