---
name: "chkrootkit"
section: "8"
platform: "linux"
package: "chkrootkit"
version: "0.58b-5+b8"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/chkrootkit/8"
---

# chkrootkit(8)

Scan the system for signs of rootkits

## NAME

chkrootkit - Scan the system for signs of rootkits

## SYNOPSIS

**chkrootkit** \[*OPTIONS*\] \[*TEST*...\]

## DESCRIPTION

**chkrootkit** examines the target system for signs that it has been tampered with. Some tools which **chkrootkit** uses can be found in **/usr/lib/chkrootkit**.

## OPTIONS

Unlike usual programmes, options cannot be 'combined', so you need to write '**-q -n**' instead of '**-qn**'

- **-q**

  Enter quiet mode. This suppresses output of tests that find nothing suspicious.

- **-x**

  Enter expert mode. This makes many tests produces additional output showing what they have found.

- **-d**

  Enter debug mode. This shows exactly what chkrootkit is doing at every step (it includes running chkrootkit with **set -x**).

- **-e "***FILE1*\[ *FILE2*...\]**"**

  **Exclude listed files from the results of some tests. The list should** **be space-separated (which will generally require quoting when run from** **a shell). You can also specify** **-e** **several times. Use this to remove false positives from the result of** **many tests - see** **/usr/share/doc/chkrootkit/README.FALSE-POSITIVES.gz**.

- **-s** *REGEXP*

  Similar to **-e** but only applies to the result of the sniffer test.  This test will class standard network managers like **systemd-networkd**(1), [**NetworkManager**(1)](/NetworkManager/1.md) or [**wpa\_supplicant**(1)](/wpa_supplicant/1.md) as packet sniffers. You can remove such messages from the output with something like **chkrootkit -s '(systemd-networkd\|NetworkManager\|wpa\_supplicant)'** (you may want to use a more precise regular expression, see **/etc/chkrootkit/chkrootkit.conf**). The argument can be any regular expression understood by [**egrep**(1)](/egrep/1.md) and is applied to every line of the output of the **ifpromisc** test .

- **-p** *DIR1*\[**:***DIR2*...\]

  Specify an alternative *$PATH*. **chkrootkit** assumes that standard programmes, like [*find*(1)](/find/1.md) and[*grep*(1)](/grep/1.md), are uncompromised. The intention is that you place trusted copies of such binaries where they cannot be modified and invoke with something like **chkrootkit -p /media/usb**

- **-r** *DIR*

  Use *DIR* as the root directory. For example, you might mount a compromised disk on an uncompromised system and run **chkrootkit -r /mnt**.

- **-n**

  make some tests ignore NFS-mounted directories.

- **-T** *FSTYPE*

  **make some tests ignore file systems of type** *FSTYPE*. This uses [**find**(1)](/find/1.md)'s **-fstype** option.

- **-l**

  Print available tests.

- **-h**

  Print a short help message and exit.

- **-V**

  Print version information and exit.

## AUTHOR

Manual page written by Yotam Rubin \<yotam@makif.omer.k12.il\>, Marcos Fouces \<marcos@debian.org\>, Lantz Moore \<lmoore@debian.org\>, and Richard Lewis \<richard.lewis.debian@googlemail.com\> for the Debian project. It may be used by others.

## SEE ALSO

[**strings**(1)](/strings/1.md) [**chklastlog**(8)](/chklastlog/8.md) [**chkwtmp**(8)](/chkwtmp/8.md)