1. All software runs within an operating system concept known as a process. Each program running on a system is assigned its own process ID (PID). Users can easily obtain a process list (using Task Manager on Windows or ps on UNIX) in order to see what is running. Key point: Trojans, rootkits, and other evil software will attempt to hide themselves from the process list, either by providing replacements to the programs that list processes (like ps), or by hooking the system calls that enumerate processes. From Hacking-Lexicon