There's a nice way to determine if a script kiddie has some evil processes running on your Unix box, using /proc. Most script kiddies will install some sort of rootkit that will modify some important binaries, such as "ps", to hide script kiddies processes. One could use following even if "ps" was changed, to see all processes on Linux:
cat /proc/*/stat |awk '{print $1,$2}' |less
On FreeBSD, one should use following:
cat /proc/*/status |awk '{print $1,$2}' |less