chkrootkit is a collection of tools to detect the presence of rootkits. chkrootkit uses C and shell scripts to perform a detailed process check, and scans systems binaries to detect kit signatures. Upon detection, in most cases, it can remove rootkits too.

Install ChkRootKit

Follow these steps to install ChkRootKit

Login to your dedicated or cloud server via SSH as root

cd /usr/local/src/

– Down load the chkrootkit.
# wget http://www.reznor.com/tools/chkrootkit.tar.gz
# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

– Unpack the chkrootkit you just downloaded.
# tar -xvzf chkrootkit.tar.gz

– Change to new directory
# cd chkrootkit-*
(select the version )

– Compile chkrootkit
# make sense

– Run chkrootkit
# ./chkrootkit

How to setup a daily scan report?

– Load crontab
# crontab -e

– Add this line to the top:
===============================================================>
0 1 * * * (cd /usr/local/src/chkrootkit*; ./chkrootkit 2>&1 | mail -s “chkrootkit output” email@domain.com)
===============================================================>