Tools such as chkrootkit and rkhunter can help flag suspicious files or system changes, but they should not be treated as proof that a machine is clean or compromised.
Useful checks
- Review authentication, system and application logs.
- Compare installed package files against the distribution package database where possible.
- Check unexpected listeners and processes with tools such as
ss,ps, andlsof. - Use rootkit scanners as one signal among several, not as the final verdict.
False positives are common, particularly after legitimate package or kernel changes.
If compromise is credible
For an important system, the safest recovery path is usually to preserve evidence as required, rotate exposed credentials, rebuild from trusted media or images, patch the original entry point, and restore only verified data. Trying to clean an unknown root-level compromise in place can leave hidden persistence behind.