Saw these running in top, can you help identify?

[Metro2]

Saw these running when I took an SSH peek at top tonight:

/usr/bin/find /dev /tmp /lib /etc /var ( -name tcp.log -o -name .linux-sniff -o -name sniff-l0g -o -name core_ )


find /lib /usr/lib /usr/local/lib -name libproc.a

I'm a bit concerned because I don't recognize them and the server load was a bit high at the moment I noticed them.

Can anyone give me an idea of what those are, friend or foe, why they'd be running?

Thank you.

[jester.ro]

hehe

had a client that came sooo close to reinstalling his box after he saw those in the process list.

that's the exact process that appears when chkrootkit is running.
Check to see if you have it start periodicaly from a cron, or maybe someone else with acces to the box was running it at the time you cheked.

But i'm pretty sure it's a cronjob.

[Metro2]

Thanks very much for the response, I'll check crons.