title: Could I find all kernel modules that are running even they are hide?
body: <p>I am starting to develop kernel modules and I wonder about all methods to know which modules are running in order to remove them (include modules that they are hide). </p>
  
  <p>E.g. The following module has two lines in order to hide him. (It is a typical rootkit development trick)</p>
  
  <pre><code>#include &lt;linux/module.h&gt;
  #include &lt;linux/init.h&gt;
  #include &lt;linux/kernel.h&gt;
  
  MODULE_LICENSE("GPL");
  int example_init(void);
  void example_exit(void);
  module_init(example_init);
  module_exit(example_exit);
  
  int example_init(void) {
      list_del_init(&amp;__this_module.list);         // Deletes entry from list and reinitialize it
      kobject_del(&amp;THIS_MODULE-&gt;mkobj.kobj);      // Unlink kobject from hierarchy 
      printk("Example: module loaded\n");
      return 0;
  }
  
  void example_exit(void) {
     printk("Example: module removed\n");
  }
  </code></pre>
  
  <p>When a module is loaded you can see the information with dmesg, lsmod, modinfo, modprobe,  /proc/modules, /sys/module or /proc/kallsyms</p>
  
  <p>My question is if exist ways to know (and remove) this module? obviusly, rmmod  doesn't work because this module doesn't appear in /proc/modules list.</p>