Question about scary process ownership

From: Alaric S. Haag - IMRlab System Manager and part-time Visigoth <system_at_imr00.me.lsu.edu>
Date: Tue, 09 May 1995 16:53:12 CDT

Hello!

Can someone more knowlegeable than I tell me from the excerpt of
(ps -ef) listed below, whether I'm being "hacked" or not? The
process owner has been wiped out with "??????" to protect the
innocent (who knows, he might be reading this!). I'm wondering
about the process line

root 22014 22006 0.0 13:21:16 ?? 0:00.26 /usr/bin/X11/xterm -ls

which seems to be in the (non-priv'd) user's process tree, (via 22006)
but belongs to root.

Can anyone (quickly!) decipher what I'm looking at here?

Many thanks!


Ric
%^{)

----
[ Alaric S. Haag, Computer Manager                      haag_at_imr00.me.lsu.edu ]
[ Louisiana State University, Mech. Engr. Dept.         FAX:   (504) 388-5924 ]
[ Baton Rouge, LA 70803                            Opinions:   (504) 388-5897 ]
                       "I've got dust in my mind's eye!!" - Me
Excerpt of ps -ef follows:
...
root     21990   367  0.0 13:21:01 ??      0:00.67 -:0 (xdm)
??????   22005 21990  0.0 13:21:13 ??      0:00.03 sh /usr/lib/X11/xdm/Xsession
??????   22006 22005  0.0 13:21:14 ??      0:00.65 dxsession
??????   22009 22006  0.0 13:21:14 ??      0:00.01 sh -c /usr/bin/X11/dxconsole -geometry
root     22010 22009  0.0 13:21:14 ??      0:00.65 /usr/bin/X11/dxconsole -geometry =+892
??????   22011 22006  0.0 13:21:15 ??      0:37.58 /usr/bin/X11/mwm
??????   22012 22006  0.0 13:21:16 ??      0:01.19 /usr/bin/X11/dxcalendar
??????   22013 22006  0.0 13:21:16 ??      0:00.66 /usr/bin/X11/dxclock
root     22014 22006  0.0 13:21:16 ??      0:00.26 /usr/bin/X11/xterm -ls
root     22854     1  0.0 16:39:58 ??      0:01.29 dxterm -ls
root       370     1  0.0   Mar 27 co      0:00.26 /usr/sbin/getty console console vt100
??????   22015 22014  0.0 13:21:17 p1      0:00.10 -csh (csh)
...

Received on Tue May 09 1995 - 17:48:40 NZST