View source for Chkrootkit

{{Short description|Software}}{{Notability|date=February 2025}}

{{lowercase|title=chkrootkit}}
{{Infobox Software
| name = chkrootkit
| screenshot = [[Image:Chkrootkit en Linux.png|200px|chkrootkit on Linux]]
| caption = chkrootkit on [[Linux]]
| developer = Nelson Murilo Klaus Steding-Jessen
| latest_release_version = 0.57
| latest_release_date = Jan 13 2023
| operating_system = [[Linux]], [[FreeBSD]], [[OpenBSD]], [[NetBSD]], [[Solaris (operating system)|Solaris]], [[HP-UX]], [[Tru64]], [[BSD/OS]], [[Mac OS X]]
| genre = [[Rootkit]] Detector
| license = 
| website = {{URL|http://www.chkrootkit.org}}
}}

'''chkrootkit''' ('''Check Rootkit''') is a [[Unix]]-based program intended to help [[system administrators]] check their system for local signs of known [[rootkit]]s.<ref>{{Cite web |last=Emms |first=Steve |date=2023-11-05 |title=chkrootkit - locally checks for signs of a rootkit |url=https://www.linuxlinks.com/chkrootkit/ |access-date=2025-03-13 |website=LinuxLinks |language=en-GB}}</ref>  It is a [[shell script]] using common UNIX/Linux tools like the <code>[[strings (Unix)|strings]]</code> and <code>[[grep]]</code> commands to search core system programs for signatures and for comparing a [[tree traversal|traversal]] of the <code>[[/proc]]</code> filesystem with the output of the <code>[[ps (Unix)|ps]]</code> (process status) command to look for discrepancies.

It can be used from a [[rescue disc]] (typically a [[live CD]]) or it can optionally use an alternative directory from which to run all of its own commands.  These techniques allow chkrootkit to trust the commands upon which it depends a bit more.

There are inherent limitations to the reliability of any program that attempts to detect compromises (such as rootkits and [[computer virus]]es). Newer rootkits may specifically attempt to detect and compromise copies of the chkrootkit programs or take other measures to evade detection by them.

==See also==
* [[Host-based intrusion detection system comparison]]
* [[Hardening (computing)]]
* [[Linux malware]]
* [[MalwareMustDie]]
* [[rkhunter]]
* [[Lynis]]
* [[OSSEC]]
* [[Samhain (software)]]

==References==
{{reflist}}

==External links==
* {{official website|www.chkrootkit.org}}

[[Category:Computer security software]]
[[Category:Unix security-related software]]
[[Category:Rootkit detection software]]

{{Unix-stub}}