chkrootkit

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Chkrootkit" – news · newspapers · books · scholar · JSTOR (September 2011) (Learn how and when to remove this message)

chkrootkit

chkrootkit on Linux
Developer(s)	Nelson Murilo Klaus Steding-Jessen
Stable release	0.57 / Jan 13 2023
Repository	chkrootkit.org/pub/seg/pac/
Operating system	Linux, FreeBSD, OpenBSD, NetBSD, Solaris, HP-UX, Tru64, BSD/OS, Mac OS X
Type	Rootkit Detector
Website	www.chkrootkit.org

Chkrootkit (Check Rootkit) is a widely used Unix-based utility designed to aid system administrators in examining their systems for rootkits. Operating as a shell script, it leverages common Unix/Linux tools such as the strings and grep command. The primary purpose is to scan core system programs for identifying signatures and to compare data obtained from traversal the /proc with the output derived from the ps (process status) command, aiming to identify inconsistencies. It offers flexibility in execution, allowing it to function from a rescue disc, often a live CD, and provides an optional alternative directory for executing its commands. These approaches enhance chkrootkit's reliance on the commands it employs.^[1]

It's crucial to recognize the inherent limitations of any program that strives to detect compromises, including rootkits and malware. Modern rootkits might deliberately attempt to identify and target copies of the chkrootkit program, or adopt other strategies to elude detection by it.

• Host-based intrusion detection system comparison
• Hardening (computing)
• Linux malware
• MalwareMustDie
• rkhunter
• Lynis
• OSSEC
• Samhain (software)

• Official website