chkrootkit

chkrootkit is a tool to locally check for signs of a rootkit. It contains:

• chkrootkit: shell script that checks system binaries for rootkit modification.
• ifpromisc: checks if the network interface is in promiscuous mode.
• chklastlog: checks for lastlog deletions.
• chkutmp.c: checks for utmp deletions.
• chkwtmp: checks for wtmp deletions.
• chkdirs: checks for signs of LKM trojans.
• chkproc: checks for signs of LKM trojans.
• strings: quick and dirty strings replacement.

A large number of rootkits, worms and LKMs are currently detected. For an updated list of rootkits, worms and LKMs detected by chkrootkit please visit: http://www.chkrootkit.org/