Detecting rootkits

Download RKHUNTER

rkhunter –update
rkhunter –propupd

vim /etc/cron.weekly/rkhunter.sh


#!/bin/sh
(
/usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /bin/mail -s 'rkhunter Weekly Run (PutYourServerNameHere)' your@email.com

chmod 755 /etc/cron.weekly/rkhunter.sh

or manual check
rkhunter –check

Download CHCKROOTKIT
chkrootkit
chkrootkit -x | less

Download ZEPPOO