Forensics 8. Cloaked daemons

Their Trojan ps doesn't show eggdrop servers, but they saved a copy of the original version:

  foo% ./ldlibps.so -fea|grep egg
   lp       2030          1  0   
      Sep 04 ?       7:41 ./eggdrop -m ccbot1.conf
   lp       2034          1  0
      Sep 04 ?       8:25 ./eggdrop -m ccbot2.conf