Chkrootkit

Chkrootkit: Open Source Rootkit Scanner

Detects malicious rootkits, hidden files, and viruses in Linux systems, providing a reliable solution for system security assessment.

What is Chkrootkit?

Chkrootkit is an open source command line tool for Linux that is used to detect rootkits and other malware on a system. A rootkit is a set of programs that allows permanent or consistent undetectable presence on a computer. Chkrootkit scans system binaries, files, and folders for anything that looks suspicious or out of the ordinary.

Some of the things that Chkrootkit checks for include hidden files, hidden processes, hidden registry entries, suspicious strings in kernel modules, and unauthorized open ports or network connections. It works by comparing binary signatures against known malicious files, comparing file properties against secure baseline versions, and cross checking various sources of system information for consistencies.

Chkrootkit is frequently updated and can detect many known rootkits and malware. However some more advanced threats may evade detection. So it is commonly used along with other security tools as part of a defense-in-depth security strategy. Chkrootkit is included in many Linux distributions by default such as Debian and Ubuntu.

Chkrootkit Features

Official Links