Hidden Process: Remove the Userland Rootkit

Processes are being hidden on this host: some PIDs visible under /proc don't show up in ps. That's the signature of a userland rootkit loaded through /etc/ld.so.preload — a shared library force-loaded into every process that filters what tools like ps and ls report. Find the rootkit and remove it: clear its entry from the global preload file and delete the malicious library. Grading reads the filesystem — the preload reference and the library must be gone. (The planted library is inert.)