.TH chkrootkit 8 "10 January 2003"
.SH NAME 
chkrootkit
\- Determine whether the system is infected with a rootkit
.SH SYNOPSIS
.B chkrootkit
[\fIOPTION\fR]... [\fITESTNAME\fR]...
.SH DESCRIPTION
.B chkrootkit
examines certain elements of the target system and determines 
whether they have been tampered with. Some tools which 
.B chkrootkit
applies while analyzing binaries and log files can be found at 
\fI\//usr/lib/chkrootkit\fR.
.SH OPTIONS
.TP
\fB\-h\fR
Print a short help message and exit.
.TP
\fB\-V\fR
Print version information and exit.
.TP
\fB\-l\fR
Print available tests. Currently, these are the following:
.RS
aliens asp bindshell lkm rexedcs sniffer w55808 wted scalper slapper z2 chkutmp OSX_RSPLUG amd basename biff chfn chsh cron crontab date du dirname echo egrep env find fingerd gpm grep hdparm su ifconfig inetd inetdconf identd init killall  ldsopreload login ls lsof mail mingetty netstat named passwd pidof pop2 pop3 ps pstree rpcinfo rlogind rshd slogin sendmail sshd syslogd tar tcpd tcpdump top telnetd timed traceroute vdir w write
.RE
.TP
\fB\-d\fR
Enter debug mode.
.TP
\fB\-x\fR
Enter expert mode.
.TP
\fB\-e\fR
Exclude known false positive files/dirs, quoted, space separated.
.TP
\fB\-q\fR
Enter quiet mode.
.TP
\fB\-r \fIdir\fR
Use 
.I dir
as the root directory.
.TP
\fB\-p \fIdir1\fR:\fIdir2\fR:\fIdirN\fR
Specify the path for the external commands used by chkrootkit.
.TP
\fB\-n\fR
skip NFS mounted dirs
.TP
\fB\-e\fR
exclude known positives. Quoted white space separated list of files/dirs. Read /usr/share/doc/chkrootkit/README.FALSE-POSITIVES previously.
.TP
\fB\-s\fR
exclude known false positive sniffer (dhcpd, ntop etc) quoted, space separated. Please, read /usr/share/doc/chkrootkit/README.FALSE-POSITIVES previously.
.
.SH "AUTHOR"
Manual page written by Yotam Rubin
.I <yotam@makif.omer.k12.il>,
Marcos Fouces
.I <marcos@debian.org>
and lantz moore
.I <lmoore@debian.org>
for the Debian project. It may be used by others.
.SH SEE ALSO
\fBstrings\fR(1)