NAME

       chkrootkit - Scan the system for signs of rootkits

SYNOPSIS

       chkrootkit [OPTION]... [TESTNAME]...

DESCRIPTION

       chkrootkit examines the target system for signs that it has been tampered with. Some tools
       which chkrootkit uses can be found in /usr/lib/chkrootkit.

OPTIONS

       Unlike usual programmes, options cannot be 'combined', so you cannot need to write '-q -n'
       instead of '-qn'

       -q     Enter quiet mode. This suppresses output of tests that find nothing suspicious.

       -x     Enter  expert  mode.  This makes many tests produces additional output showing what
              they have found.

       -d     Enter debug mode. This shows exactly what chkrootkit is doing  at  every  step  (it
              includes running chkrootkit with 'set -x').

       -e "FILE1[ FILE2...]"
              Exclude  listed  files  from  the  results  of some tests. The list should be pace-
              separated (which will generally require quoting when run from a shell. You can also
              specify  -e  several  times). Use this to remove false positives from the result of
              many tests - see /usr/share/doc/chkrootkit/README.FALSE-POSITIVES.

       -s REGEXP
              Similar to -e but only applies to the result of the sniffer test.  This  test  will
              flag         standard         network         managers         like        systemd-
              networkd(1), NetworkManager(1) or wpa_supplicant(1) as PACKET SNIFFER  s,  and  you
              can    remove    such    messages    from    the   output   with   something   like
              chkrootkit -s '(systemd-netword|NetworkManager|wpa_supplicant)', where the argument
              lists  whicher  managers  you expect to be present. The argument can be any regular
              expression understood by egrep(1).

       -p DIR1[:DIR2...]
              Specify an alternative $PATH.  chkrootkit assumes that  standard  programmes,  like
              find(1)  andgrep(1),  are  uncompromised.  The  intention is that you place trusted
              copies  where  they  cannot  be   modified   and   invoke   with   something   like
              chkrootkit -p /media/usb

       -r     DIR  Use  DIR  as  the  root  directory.  For example, you might mount a disk on an
              uncompromised system and run chkrootkit-r/mnt

       -n     make some tests ignore NFS-mounted directories.

       -l     Print available tests. These are the following:
              aliens asp bindshell lkm rexedcs sniffer w55808 wted  scalper  slapper  z2  chkutmp
              OSX_RSPLUG  amd basename biff chfn chsh cron crontab date du dirname echo egrep env
              find fingerd gpm grep hdparm  su  ifconfig  inetd  inetdconf  identd  init  killall
              ldsopreload  login  ls  lsof  mail mingetty netstat named passwd pidof pop2 pop3 ps
              pstree rpcinfo rlogind rshd slogin sendmail  sshd  syslogd  tar  tcpd  tcpdump  top
              telnetd timed traceroute vdir w write

       -h     Print a short help message and exit.

       -V     Print version information and exit.

AUTHOR

       Manual   page   written   by   Yotam   Rubin   <yotam@makif.omer.k12.il>,   Marcos  Fouces
       <marcos@debian.org> and lantz moore <lmoore@debian.org> for the Debian project. It may  be
       used by others.

SEE ALSO

       strings(1) chklastlog(8) chkwtmp(8)

                                           Oct 23, 2021                             chkrootkit(8)