My server is compromised, and I try to get the open files of the malicious user, it says that the user does not have a UID , so it cannot find anything. I see there are processes which are running by that user but I cannot get the files opened by it. 
why the username does not have a UID?
security;kill;lsof
it says that the user does not have a UIDI can certainly agree with that.  A user as defined by malicious user running things on a server does not have an UID, but that is because that user is a person who may (perhaps) run things as different UIDs on your machine (from now on I'll stick to the term attacker).Therefore the correct path is to try to figure out what path the attacker took to gain control of a process on your machine that could perform fork() and exec().  That is a pretty good starting point because, at the end of the day, a successful attack starts by gaining control (possibly in a very convoluted way) of a process that can do that.  How the attacker manages to get to that point is what varies in the attack.That said, the canon answer on what to do with a compromised server is to nuke it from orbit.  It is not your computer anymore, and you cannot be sure on how much access the attacker achieved.  Has the attacker achieved root privileges, then you may as well be connecting to a VM running on what once has been your server.  Or you could even be dealing against a rootkit.(Note: nuke from orbit means a fresh install by most people)Back to the actual question:why the username does not have a UID?Or better, the implied one by the text of the question:(how a process is running without an UID?)The idea that a process is running without an UID is absurd.  The kernel structure that maintains the existence of a process (actually the KSE) contains an UID field which must be populated (even if it is populated with rubbish in case of, say, a kernel bug).  Therefore every process always has an UID.What you are most likely dealing with is that the UID is not listed in /etc/passwd, which, although strange for a process, is no different from doing touch leet; chown 1337 leet (assuming that you do not have a user leet with that UID , that is).  Pretty much all standard *nix tools work on UIDs as they would for usernames.  i.e.lsof -u usernameis equivalent tolsof -u `id -u username`Andfind . -user usernameis also equivalent tofind . -user `id -u username`Therefore back to the first quote (emphasis mine):it says that the user does not have a UIDWhatever the it is in there, it is not a standard *nix tool.  Or you're really more screwed than you believe, and are running inside some rather strange environment created by the attacker.