thelinuxlink.net

This is a nice tutorial at HowToForge on scanning for Rootkits.

# ./chrootkit -r /mnt/hda2_image

I prefer rkhunter because it doesn't give me false positives like chkrootkit does. But they both should serve their purpose just don't be surprised if chkrootkit says you have one and you didn't think you did. (Google is your friend)

CptnObvious999 wrote:I prefer rkhunter because it doesn't give me false positives like chkrootkit does. But they both should serve their purpose just don't be surprised if chkrootkit says you have one and you didn't think you did. (Google is your friend)

++