Take the 2-minute tour ×

Using Ubuntu 12.04. is there any way to hide a running process ? That process shouldn't' display in system monitor,top,htop . There is no problem to remember the process id (PID) so observation of the process can be done easily .but i want to hide the process completely . is there any way ?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

I would highly recommend you to change the process name and give it some other name so that it might look like you are running some different process.

Example: you can change the process name from "chrome" to "findme".

This can be done programmatically.


You can play around at kernel level (pid_getattr) to make it possible. Again this is not recommended.


WARNING !!! Don't try the below answer:

If you wanna still go ahead and remove the process from top, there are few softwares which can do that for us. One among those software is called "Rootkits"

Rootkits: When rootkits is installed it overwrites the commands. It can overwrite the command like ps,ls,netstat,find,du,ifconfig,login,killall, etc..

There many malicious software with the same name. So be careful it might infect your system.

Unhide: To detect the hidden process you can use unhide.

share|improve this answer
could you provide more about usage on pid_getattr , thank you. –  Raja Sep 1 '12 at 17:25
@GrSr use the book and look at section 10.1.7 Task related information. It might help you to tweak the kernel –  devav2 Sep 1 '12 at 18:14
Thank you i will see . –  Raja Sep 2 '12 at 7:20

It is impossible to hide the process unless one starts messing around in the kernel to limit this.

One technique is to change the process name using:

prctl(PR_SET_NAME, (unsigned long) "NewName", 0, 0, 0);

..and if possible to fork() and let the parent process die. If you were to do that periodically it makes it harder to track down the process.

share|improve this answer
nice command thank you .:) –  Raja Sep 1 '12 at 17:23

You could modify the code of the various process monitors and recompile them. I don't know exactly how process monitors get info about running processes, but I guess they get it from the linux kernel, i.e. if you modify that, it might also work, for any process monitor.

Why exactly do you want to hide the process? Do you want to filter the list of processes (easy with ps+grep commands) or really make it impossible to see it, unless you know the process ID?

share|improve this answer

Your Answer


