A tool to locally check for signs of a rootkit https://www.chkrootkit.org/
Go to file
2024-01-05 21:12:50 +01:00
chkrootkit.spec automatic update by autodist [release 0.53-1mamba;Sun Apr 19 2020] 2024-01-05 21:12:50 +01:00
README.md automatic update by autodist [release 0.50-1mamba;Wed Jul 02 2014] 2024-01-05 21:12:50 +01:00

chkrootkit

chkrootkit is a tool to locally check for signs of a rootkit. It contains:

  • chkrootkit: shell script that checks system binaries for rootkit modification.
  • ifpromisc: checks if the network interface is in promiscuous mode.
  • chklastlog: checks for lastlog deletions.
  • chkutmp.c: checks for utmp deletions.
  • chkwtmp: checks for wtmp deletions.
  • chkdirs: checks for signs of LKM trojans.
  • chkproc: checks for signs of LKM trojans.
  • strings: quick and dirty strings replacement.

A large number of rootkits, worms and LKMs are currently detected. For an updated list of rootkits, worms and LKMs detected by chkrootkit please visit: http://www.chkrootkit.org/.