http://rootkit.nl/articles/rootkit_s...echniques.html
Hidden files
Although 'hidden' files can be usefull, sometimes they are an unwanted part of the system. By scanning for hidden files on places where they are not supposed to be (like in /tmp), we can track down some possible evil files.
Linux
- compare processes in `ps` against the available files in /proc
Osea, los rootkits ocultan procesos y archivos, ¿Que piensan que ocultan, los MP3?