unhide.rb - Forensic tool to find processes hidden by rootkits

Property Value
Distribution Debian 7 (Wheezy)
Repository Debian Main i386
Package name unhide.rb
Package version 13
Package release 1.1
Package architecture all
Package type deb
Installed size 56 B
Download size 6.35 KB
Official Mirror ftp.br.debian.org
Unhide.rb is a reimplementation of unhide in Ruby.
It currently does the does the same checks as "unhide proc" and "unhide sys",
while being about 10x faster than the original C code.
It also has better diagnostics when hidden processes are found.
This package can be used by rkhunter in its daily scans.


Package Version Architecture Repository
unhide.rb_13-1.1_all.deb 13 all Debian Main
unhide.rb - - -


Name Value
ruby1.8 -


Type URL
Binary Package unhide.rb_13-1.1_all.deb
Source Package unhide.rb

Install Howto

  1. Update the package index:
    # sudo apt-get update
  2. Install unhide.rb deb package:
    # sudo apt-get install unhide.rb




2012-12-04 - C├ędric Boutillier <boutil@debian.org>
unhide.rb (13-1.1) unstable; urgency=high
* Non-maintainer upload.
* Set urgency to high, as a RC bug is fixed.
* Use Ruby 1.8 instead of default Ruby 1.9 version. (Closes: #677650)
+ add debian/patches/use_ruby18.patch, changing the shebang of unhide.rb
to /usr/bin/ruby1.8 as it contains code not compatible with Ruby 1.9,
+ Depends on ruby1.8 instead of ruby.
2011-07-08 - Julien Valroff <julien@debian.org>
unhide.rb (13-1) unstable; urgency=low
* New upstream snapshot:
+ Report suspicious things on stderr
+ Add a second run to filter out some false positives
2011-05-08 - Julien Valroff <julien@debian.org>
unhide.rb (12-3) unstable; urgency=low
* Fix maintainer address 
2011-05-01 - Julien Valroff <julien@debian.org>
unhide.rb (12-2) unstable; urgency=low
* Update to new policy 3.9.2 (no changes needed)
* Add rkhunter-propupd trigger call
* Fix VCS-* fields 
2011-03-20 - Julien Valroff <julien@debian.org>
unhide.rb (12-1) unstable; urgency=low
* Initial release. (Closes: #617956)

See Also

Package Description
unhide_20110113-4_i386.deb Forensic tool to find hidden processes and ports
unhtml_2.3.9-3_i386.deb Remove the markup tags from an HTML file
uni2ascii_4.18-2_i386.deb UTF-8 to 7-bit ASCII and vice versa converter
unicode-data_6.1.0-1_all.deb Property data for the Unicode character set
unicode-screensaver_0.4-1_i386.deb screensaver displaying unicode characters
unicode_0.9.5_all.deb display unicode character properties
unicon-imc2_3.0.4-13_i386.deb Chinese Input Method Library
uniconf-tools_4.6.1-5_i386.deb Tools to interface with UniConf
uniconfd_4.6.1-5_i386.deb Server that manages UniConf elements
unicorn_4.3.1-4_i386.deb Rack HTTP server for fast clients
unifdef_2.6-1_i386.deb Remove cpp '#ifdef' lines from files
unifont-bin_5.1.20080914-1.3_i386.deb utilities for manipulating the GNU Unifont
unifont_5.1.20080914-1.3_all.deb font with a glyph for each visible Unicode 5.1 Plane 0 character
unionfs-fuse_0.24-2.2_i386.deb Fuse implementation of unionfs
unison-all-gtk_2.40+1_all.deb file synchronization tool (all GTK+ versions)