Check-ps is a program that is designed to detect rootkit versions of ps that fail to tell you about selected processes. It currently requires /proc but other scanning methods can be implemented. The program will run in the background or one-shot mode. Check-ps has grown rather to better resist increasingly sophisticated attacks, generate more useful reports, and implement more detection methods. You are encouraged to check the signatures, available here.
You can download it from the following link: https://packetstormsecurity.com/files/download/24678/check-ps-1.3.2.tar.gz
Source: https://packetstormsecurity.com/files/24678/check-ps-1.3.2.tar.gz.html