# chkrootkit

chkrootkit is a tool to locally check for signs of a rootkit.
It contains:
* chkrootkit: shell script that checks system binaries for rootkit modification.
* ifpromisc: checks if the network interface is in promiscuous mode.
* chklastlog: checks for lastlog deletions.
* chkutmp.c: checks for utmp deletions.
* chkwtmp: checks for wtmp deletions.
* chkdirs: checks for signs of LKM trojans.
* chkproc: checks for signs of LKM trojans.
* strings: quick and dirty strings replacement.

A large number of rootkits, worms and LKMs are currently detected.
For an updated list of rootkits, worms and LKMs detected by chkrootkit please visit: http://www.chkrootkit.org/.