Chkrootkit

What is Chkrootkit?

Chkrootkit is a command‑line tool that checks for known rootkits, backdoors, and kernel exploits by scanning binaries and system files. It was first released in 2003 and has been maintained by the open‑source community, with regular updates to its signature database.

The program is aimed at sysadmins, security professionals, and power users who prefer a lightweight, scriptable tool over GUI antivirus solutions.

Compared to Malwarebytes or Windows Defender, Chkrootkit is less user‑friendly but offers a quick, no‑frills scan that can be integrated into cron jobs or automated monitoring scripts.

Best for: Systems that need quick, automated rootkit checks without a GUI.

Key features of Chkrootkit

• Command‑line interface
• Signature‑based rootkit detection
• Checks for hidden processes and files
• Scans kernel modules
• Detects known backdoors
• Provides a log of findings
• Supports multiple Linux distributions

Tips for Windows users

If you’re used to Malwarebytes or Windows Defender, you’ll notice Chkrootkit lacks a graphical interface and real‑time scanning. Instead, run it from a terminal or schedule it with cron. The output is plain text, so you’ll need to parse it or redirect it to a log file. There are no file‑format differences—just run chkrootkit and read the console output.