Procedemos a instalar rkhunter (puedes instalar con apt, zypper, yum, dependerá de tu distribución linux):

sudo aptitude install rkhunter

Como actualizarlo:

rkhunter --propupd

Ejecutar analisis:

rkhunter --check

La aplicación realizara una serie de escaneos y nos pedirá que clickemos la tecla ENTER para continuar. El resultado lo podremos ver en el fichero /var/log/rkhunter.log
Sería algo similar a esto:

[08:31:00] Running Rootkit Hunter version 1.4.2 on linux-sf0e
[08:31:00]
[08:31:00] Info: Start date is Sun Jun 28 08:31:00 CEST 2015
[08:31:00]
[08:31:00] Checking configuration file and command-line options...
[08:31:00] Info: Detected operating system is 'Linux'
[08:31:01] Info: Found O/S name: openSUSE 13.2 (x86_64)
[08:31:01] Info: Command line is /usr/bin/rkhunter --no-mail-on-warning --cronjob --report-warnings-only --append-log --pkgmgr RPM --createlogfile /var/log/rkhunter.log
[08:31:01] Info: Environment shell is /bin/sh; rkhunter is using bash
[08:31:01] Info: Using configuration file '/etc/rkhunter.conf'
[08:31:01] Info: Using local configuration directory '/etc/rkhunter.d': 1 file found
[08:31:01] Info: Installation directory is '/usr'
[08:31:01] Info: Using language 'en'
[08:31:01] Info: Using '/var/lib/rkhunter/db' as the database directory
[08:31:01] Info: Using '/usr/lib64/rkhunter/scripts' as the support script directory
[08:31:01] Info: Using '/bin /usr/bin /sbin /usr/sbin /usr/local/bin /usr/local/sbin' as the command directories
[08:31:01] Info: Using '/var/lib/rkhunter/tmp' as the temporary directory
[08:31:01] Info: Disabling use of mail-on-warning at users request
[08:31:01] Info: X will be automatically detected
[08:31:01] Info: Found the 'basename' command: /bin/basename
[08:31:01] Info: Found the 'diff' command: /usr/bin/diff
[08:31:01] Info: Found the 'dirname' command: /usr/bin/dirname
[08:31:01] Info: Found the 'file' command: /usr/bin/file
[08:31:01] Info: Found the 'find' command: /bin/find
[08:31:01] Info: Found the 'ifconfig' command: /sbin/ifconfig
[08:31:01] Info: Found the 'ip' command: /bin/ip
[08:31:01] Info: Found the 'ipcs' command: /usr/bin/ipcs
[08:31:01] Info: Found the 'ldd' command: /usr/bin/ldd
[08:31:01] Info: Found the 'lsattr' command: /usr/bin/lsattr
[08:31:01] Info: Found the 'lsmod' command: /bin/lsmod
[08:31:01] Info: Found the 'lsof' command: /usr/bin/lsof
[08:31:01] Info: Found the 'mktemp' command: /bin/mktemp
[08:31:01] Info: Found the 'netstat' command: /bin/netstat
[08:31:01] Info: Found the 'perl' command: /usr/bin/perl
[08:31:01] Info: Found the 'pgrep' command: /bin/pgrep
[08:31:01] Info: Found the 'ps' command: /bin/ps
[08:31:02] Info: Found the 'pwd' command: /bin/pwd
[08:31:02] Info: Found the 'readlink' command: /bin/readlink
[08:31:02] Info: Found the 'stat' command: /bin/stat
[08:31:02] Info: Found the 'strings' command: /usr/bin/strings
[08:31:02] Info: System is not using prelinking
[08:31:02] Info: Using the '/usr/bin/sha1sum' command for the file hash checks
[08:31:02] Info: Stored hash values used hash function '/usr/bin/sha1sum'
[08:31:02] Info: Stored hash values used package manager 'RPM'
[08:31:02] Info: The hash function field index is set to 1
[08:31:02] Info: Using package manager 'RPM' for file property checks
[08:31:02] Info: Found the 'rpm' command: /bin/rpm
[08:31:02] Info: Previous file attributes were stored
[08:31:02] Info: Enabled tests are: all
[08:31:02] Info: Disabled tests are: suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
[08:31:02] Info: Including user files for file properties check:
[08:31:02]       /etc/rkhunter.conf
[08:31:02]       /etc/rkhunter.d/00-opensuse.conf
[08:31:02] Info: Current logging will be appended to the log file
[08:31:02] Info: Found ksym file '/proc/kallsyms'
[08:31:02] Info: Using 'date' to process epoch second times
[08:31:02]
[08:31:02] Checking if the O/S has changed since last time...
[08:31:02] Info: Nothing seems to have changed.
[08:31:02] Info: Locking is not being used
[08:31:02]
[08:31:02] Starting system checks...
[08:31:02]
[08:31:02] Info: Starting test name 'system_commands'
[08:31:02] Checking system commands...
[08:31:03]
[08:31:03] Info: Starting test name 'strings'
[08:31:03] Performing 'strings' command checks
[08:31:03]   Scanning for string /usr/sbin/ntpsx             [ OK ]
[08:31:03]   Scanning for string /usr/sbin/.../bkit-ava      [ OK ]
[08:31:03]   Scanning for string /usr/sbin/.../bkit-d        [ OK ]
[08:31:03]   Scanning for string /usr/sbin/.../bkit-shd      [ OK ]
[08:31:03]   Scanning for string /usr/sbin/.../bkit-f        [ OK ]
[08:31:03]   Scanning for string /usr/include/.../proc.h     [ OK ]
[08:31:03]   Scanning for string /usr/include/.../.bash_history [ OK ]
[08:31:03]   Scanning for string /usr/include/.../bkit-get   [ OK ]
[08:31:03]   Scanning for string /usr/include/.../bkit-dl    [ OK ]
[08:31:03]   Scanning for string /usr/include/.../bkit-screen [ OK ]
[08:31:03]   Scanning for string /usr/include/.../bkit-sleep [ OK ]
[08:31:03]   Scanning for string /usr/lib/.../bkit-adore.o   [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../ls             [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../netstat        [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../lsof           [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../bkit-ssh/bkit-shdcfg [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../bkit-ssh/bkit-shhk [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../bkit-ssh/bkit-pw [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../bkit-ssh/bkit-shrs [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../bkit-ssh/bkit-mots [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../uconf.inv      [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../psr            [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../find           [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../pstree         [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../slocate        [ OK ]
[08:31:04]   Scanning for string /usr/lib/.../du             [ OK ]
[08:31:05]   Scanning for string /usr/lib/.../top            [ OK ]
[08:31:05]   Scanning for string /usr/sbin/...               [ OK ]
[08:31:05]   Scanning for string /usr/include/...            [ OK ]
[08:31:05]   Scanning for string /usr/include/.../.tmp       [ OK ]
[08:31:05]   Scanning for string /usr/lib/...                [ OK ]
[08:31:05]   Scanning for string /usr/lib/.../.ssh           [ OK ]
[08:31:05]   Scanning for string /usr/lib/.../bkit-ssh       [ OK ]
[08:31:05]   Scanning for string /usr/lib/.bkit-             [ OK ]
[08:31:05]   Scanning for string /tmp/.bkp                   [ OK ]
[08:31:05]   Scanning for string /tmp/.cinik                 [ OK ]
[08:31:05]   Scanning for string /tmp/.font-unix/.cinik      [ OK ]
[08:31:05]   Scanning for string /lib/.sso                   [ OK ]
[08:31:05]   Scanning for string /lib/.so                    [ OK ]
[08:31:05]   Scanning for string /var/run/...dica/clean      [ OK ]
[08:31:05]   Scanning for string /var/run/...dica/dxr        [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/read       [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/write      [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/lf         [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/xl         [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/xdr        [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/psg        [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/secure     [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/rdx        [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/va         [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/cl.sh      [ OK ]
[08:31:06]   Scanning for string /var/run/...dica/last.log   [ OK ]
[08:31:06]   Scanning for string /usr/bin/.etc               [ OK ]
[08:31:06]   Scanning for string /etc/sshd_config            [ OK ]
[08:31:06]   Scanning for string /etc/ssh_host_key           [ OK ]
[08:31:06]   Scanning for string /etc/ssh_random_seed        [ OK ]
[08:31:06]   Scanning for string /dev/ptyp                   [ OK ]
[08:31:06]   Scanning for string /dev/ptyq                   [ OK ]
[08:31:06]   Scanning for string /dev/ptyr                   [ OK ]
[08:31:07]   Scanning for string /dev/ptys                   [ OK ]
[08:31:07]   Scanning for string /dev/ptyt                   [ OK ]
[08:31:07]   Scanning for string /dev/fd/.88/freshb-bsd      [ OK ]
[08:31:07]   Scanning for string /dev/fd/.88/fresht          [ OK ]
[08:31:07]   Scanning for string /dev/fd/.88/zxsniff         [ OK ]
[08:31:07]   Scanning for string /dev/fd/.88/zxsniff.log     [ OK ]
[08:31:07]   Scanning for string /dev/fd/.99/.ttyf00         [ OK ]
[08:31:07]   Scanning for string /dev/fd/.99/.ttyp00         [ OK ]
[08:31:07]   Scanning for string /dev/fd/.99/.ttyq00         [ OK ]
[08:31:07]   Scanning for string /dev/fd/.99/.ttys00         [ OK ]
[08:31:07]   Scanning for string /dev/fd/.99/.pwsx00         [ OK ]
[08:31:07]   Scanning for string /etc/.acid                  [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/sched_host.2   [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/random_d.2     [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/set_pid.2      [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/setrgrp.2      [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/TOHIDE         [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/cons.saver     [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/adore/ava/ava  [ OK ]
[08:31:08]   Scanning for string /usr/lib/.fx/adore/adore/adore.ko [ OK ]
[08:31:08]   Scanning for string /bin/sysback                [ OK ]
[08:31:08]   Scanning for string /usr/local/bin/sysback      [ OK ]
[08:31:09]   Scanning for string /usr/lib/.tbd               [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/t0rns     [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/du        [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/ls        [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/t0rnsb    [ OK ]Software/
[08:31:09]   Scanning for string /dev/.lib/lib/lib/ps        [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/t0rnp     [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/find      [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/ifconfig  [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/pg        [ OK ]
[08:31:09]   Scanning for string /dev/.lib/lib/lib/ssh.tgz   [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/top       [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/sz        [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/login     [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/in.fingerd [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/1i0n.sh   [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/pstree    [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/in.telnetd [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/mjy       [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/sush      [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/tfn       [ OK ]
[08:31:10]   Scanning for string /dev/.lib/lib/lib/name      [ OK ]
[08:31:11]   Scanning for string /dev/.lib/lib/lib/getip.sh  [ OK ]
[08:31:11]   Scanning for string /usr/info/.torn/sh*         [ OK ]
[08:31:11]   Scanning for string /usr/src/.puta/.1addr       [ OK ]
[08:31:11]   Scanning for string /usr/src/.puta/.1file       [ OK ]
[08:31:11]   Scanning for string /usr/src/.puta/.1proc       [ OK ]
[08:31:11]   Scanning for string /usr/src/.puta/.1logz       [ OK ]
[08:31:11]   Scanning for string /usr/info/.t0rn             [ OK ]
[08:31:11]   Scanning for string /dev/.lib                   [ OK ]
[08:31:11]   Scanning for string /dev/.lib/lib               [ OK ]
[08:31:11]   Scanning for string /dev/.lib/lib/lib           [ OK ]
[08:31:11]   Scanning for string /dev/.lib/lib/lib/dev       [ OK ]
[08:31:11]   Scanning for string /dev/.lib/lib/scan          [ OK ]
[08:31:11]   Scanning for string /usr/src/.puta              [ OK ]
[08:31:11]   Scanning for string /usr/man/man1/man1          [ OK ]
[08:31:12]   Scanning for string /usr/man/man1/man1/lib      [ OK ]
[08:31:12]   Scanning for string /usr/man/man1/man1/lib/.lib [ OK ]
[08:31:12]   Scanning for string /usr/man/man1/man1/lib/.lib/.backup [ OK ]
[08:31:12]
[08:31:12] Info: Starting test name 'shared_libs'
[08:31:12] Performing 'shared libraries' checks
[08:31:12]   Checking for preloading variables               [ None found ]
[08:31:12]   Checking for preloaded libraries                [ None found ]
[08:31:12]
[08:31:12] Info: Starting test name 'shared_libs_path'
[08:31:12]   Checking LD_LIBRARY_PATH variable               [ Not found ]
[08:31:12]
[08:31:12] Info: Starting test name 'properties'
[08:31:12] Performing file properties checks
[08:31:12]   Checking for prerequisites                      [ OK ]
[08:31:14]   /bin/awk                                        [ OK ]
[08:31:15]   /bin/basename                                   [ OK ]
[08:31:16]   /bin/bash                                       [ OK ]
[08:31:16]   /bin/cat                                        [ OK ]
[08:31:17]   /bin/chmod                                      [ OK ]
[08:31:17]   /bin/chown                                      [ OK ]
[08:31:18]   /bin/cp                                         [ OK ]
[08:31:18]   /bin/csh                                        [ OK ]
[08:31:19]   /bin/date                                       [ OK ]
[08:31:19]   /bin/df                                         [ OK ]
[08:31:20]   /bin/dmesg                                      [ OK ]
[08:31:20]   /bin/echo                                       [ OK ]
[08:31:21]   /bin/ed                                         [ Warning ]
[08:31:21] Warning: The file properties have changed:
[08:31:21]          File: /bin/ed
[08:31:21]          Current inode: 711164    Stored inode: 672285
[08:31:22]   /bin/egrep                                      [ OK ]
[08:31:22]   /bin/fgrep                                      [ OK ]
[08:31:22]   /bin/find                                       [ OK ]
[08:31:23]   /bin/fuser                                      [ OK ]
[08:31:23]   /bin/grep                                       [ OK ]
[08:31:25]   /bin/ip                                         [ Warning ]
[08:31:25] Warning: The file properties have changed:
[08:31:25]          File: /bin/ip
[08:31:25]          Current inode: 737814    Stored inode: 148467
[08:31:25]   /bin/kill                                       [ OK ]
[08:31:26]   /bin/logger                                     [ OK ]
[08:31:26]   /bin/login                                      [ OK ]
[08:31:27]   /bin/ls                                         [ OK ]
[08:31:27]   /bin/lsmod                                      [ OK ]
[08:31:28]   /bin/mail                                       [ OK ]
[08:31:28]   /bin/md5sum                                     [ OK ]
[08:31:28]   /bin/mktemp                                     [ OK ]
[08:31:29]   /bin/more                                       [ OK ]
[08:31:29]   /bin/mount                                      [ OK ]
[08:31:30]   /bin/mv                                         [ OK ]
[08:31:30]   /bin/netstat                                    [ OK ]
[08:31:31]   /bin/pgrep                                      [ OK ]
[08:31:31]   /bin/ping                                       [ OK ]
[08:31:32]   /bin/pkill                                      [ OK ]
[08:31:32]   /bin/ps                                         [ OK ]
[08:31:33]   /bin/pwd                                        [ OK ]
[08:31:33]   /bin/readlink                                   [ OK ]
[08:31:34]   /bin/rpm                                        [ OK ]
[08:31:34]   /bin/sed                                        [ OK ]
[08:31:35]   /bin/sh                                         [ OK ]
[08:31:36]   /bin/sort                                       [ OK ]
[08:31:36]   /bin/stat                                       [ OK ]
[08:31:37]   /bin/su                                         [ OK ]
[08:31:38]   /bin/touch                                      [ OK ]
[08:31:38]   /bin/uname                                      [ OK ]
[08:31:39]   /bin/gawk                                       [ OK ]
[08:31:39]   /bin/tcsh                                       [ OK ]
[08:31:40]   /bin/kmod                                       [ OK ]
[08:31:41]   /bin/systemd                                    [ OK ]
[08:31:42]   /bin/systemctl                                  [ OK ]
[08:31:42]   /usr/bin/awk                                    [ OK ]
[08:31:43]   /usr/bin/basename                               [ OK ]
[08:31:43]   /usr/bin/cat                                    [ OK ]
[08:31:44]   /usr/bin/chattr                                 [ Warning ]
[08:31:44] Warning: The file properties have changed:
[08:31:44]          File: /usr/bin/chattr
[08:31:44]          Current inode: 726646    Stored inode: 537513
[08:31:45]   /usr/bin/chkconfig                              [ OK ]
[08:31:46]   /usr/bin/chmod                                  [ OK ]
[08:31:46]   /usr/bin/chown                                  [ OK ]
[08:31:47]   /usr/bin/chroot                                 [ OK ]
[08:31:47]   /usr/bin/cp                                     [ OK ]
[08:31:47]   /usr/bin/csh                                    [ OK ]
[08:31:48]   /usr/bin/curl                                   [ Warning ]
[08:31:48] Warning: The file properties have changed:
[08:31:48]          File: /usr/bin/curl
[08:31:48]          Current inode: 738098    Stored inode: 367847
[08:31:49]   /usr/bin/cut                                    [ OK ]
[08:31:49]   /usr/bin/date                                   [ OK ]
[08:31:50]   /usr/bin/df                                     [ OK ]
[08:31:50]   /usr/bin/diff                                   [ OK ]
[08:31:50]   /usr/bin/dirname                                [ OK ]
[08:31:51]   /usr/bin/dmesg                                  [ OK ]
[08:31:51]   /usr/bin/du                                     [ OK ]
[08:31:52]   /usr/bin/echo                                   [ OK ]
[08:31:52]   /usr/bin/ed                                     [ Warning ]
[08:31:52] Warning: The file properties have changed:
[08:31:52]          File: /usr/bin/ed
[08:31:52]          Current inode: 711165    Stored inode: 672286
[08:31:53]   /usr/bin/egrep                                  [ OK ]
[08:31:53]   /usr/bin/env                                    [ OK ]
[08:31:53]   /usr/bin/fgrep                                  [ OK ]
[08:31:54]   /usr/bin/file                                   [ OK ]
[08:31:54]   /usr/bin/find                                   [ OK ]
[08:31:55]   /usr/bin/grep                                   [ OK ]
[08:31:55]   /usr/bin/groups                                 [ OK ]
[08:31:55]   /usr/bin/head                                   [ OK ]
[08:31:56]   /usr/bin/id                                     [ OK ]
[08:31:56]   /usr/bin/kill                                   [ OK ]
[08:31:57]   /usr/bin/killall                                [ OK ]
[08:31:57]   /usr/bin/last                                   [ OK ]
[08:31:58]   /usr/bin/lastlog                                [ OK ]
[08:31:59]   /usr/bin/ldd                                    [ Warning ]
[08:31:59] Warning: The file properties have changed:
[08:31:59]          File: /usr/bin/ldd
[08:31:59]          Current inode: 749139    Stored inode: 538525
[08:31:59]   /usr/bin/less                                   [ OK ]
[08:32:00]   /usr/bin/locate                                 [ OK ]
[08:32:00]   /usr/bin/logger                                 [ OK ]
[08:32:01]   /usr/bin/ls                                     [ OK ]
[08:32:01]   /usr/bin/lsattr                                 [ Warning ]
[08:32:01] Warning: The file properties have changed:
[08:32:01]          File: /usr/bin/lsattr
[08:32:01]          Current inode: 726647    Stored inode: 537514
[08:32:01]   /usr/bin/lsmod                                  [ OK ]
[08:32:02]   /usr/bin/lsof                                   [ Warning ]
[08:32:02] Warning: The file properties have changed:
[08:32:02]          File: /usr/bin/lsof
[08:32:02]          Current inode: 711182    Stored inode: 672314
[08:32:03]   /usr/bin/lynx                                   [ OK ]
[08:32:03]   /usr/bin/mail                                   [ OK ]
[08:32:04]   /usr/bin/md5sum                                 [ OK ]
[08:32:04]   /usr/bin/mktemp                                 [ OK ]
[08:32:05]   /usr/bin/more                                   [ OK ]
[08:32:05]   /usr/bin/mount                                  [ OK ]
[08:32:06]   /usr/bin/mv                                     [ OK ]
[08:32:06]   /usr/bin/newgrp                                 [ OK ]
[08:32:07]   /usr/bin/passwd                                 [ OK ]
[08:32:08]   /usr/bin/perl                                   [ OK ]
[08:32:08]   /usr/bin/pgrep                                  [ OK ]
[08:32:08]   /usr/bin/ping                                   [ OK ]
[08:32:09]   /usr/bin/pkill                                  [ OK ]
[08:32:09]   /usr/bin/ps                                     [ OK ]
[08:32:09]   /usr/bin/pstree                                 [ OK ]
[08:32:10]   /usr/bin/pwd                                    [ OK ]
[08:32:10]   /usr/bin/readlink                               [ OK ]
[08:32:11]   /usr/bin/rkhunter                               [ OK ]
[08:32:11]   /usr/bin/runcon                                 [ OK ]
[08:32:12]   /usr/bin/sed                                    [ OK ]
[08:32:12]   /usr/bin/sh                                     [ OK ]
[08:32:13]   /usr/bin/sha1sum                                [ OK ]
[08:32:13]   /usr/bin/sha224sum                              [ OK ]
[08:32:14]   /usr/bin/sha256sum                              [ OK ]
[08:32:14]   /usr/bin/sha384sum                              [ OK ]
[08:32:15]   /usr/bin/sha512sum                              [ OK ]
[08:32:18]   /usr/bin/size                                   [ OK ]
[08:32:19]   /usr/bin/sort                                   [ OK ]
[08:32:20]   /usr/bin/ssh                                    [ OK ]
[08:32:20]   /usr/bin/stat                                   [ OK ]
[08:32:21]   /usr/bin/strace                                 [ OK ]
[08:32:21]   /usr/bin/strings                                [ OK ]
[08:32:21]   /usr/bin/su                                     [ OK ]
[08:32:22]   /usr/bin/sudo                                   [ OK ]
[08:32:22]   /usr/bin/tail                                   [ OK ]
[08:32:23]   /usr/bin/telnet                                 [ OK ]
[08:32:23]   /usr/bin/test                                   [ OK ]
[08:32:23]   /usr/bin/top                                    [ OK ]
[08:32:24]   /usr/bin/touch                                  [ OK ]
[08:32:24]   /usr/bin/tr                                     [ OK ]
[08:32:25]   /usr/bin/uname                                  [ OK ]
[08:32:25]   /usr/bin/uniq                                   [ OK ]
[08:32:26]   /usr/bin/users                                  [ OK ]
[08:32:26]   /usr/bin/vmstat                                 [ OK ]
[08:32:27]   /usr/bin/w                                      [ OK ]
[08:32:27]   /usr/bin/watch                                  [ OK ]
[08:32:27]   /usr/bin/wc                                     [ OK ]
[08:32:28]   /usr/bin/wget                                   [ OK ]
[08:32:28]   /usr/bin/whatis                                 [ OK ]
[08:32:29]   /usr/bin/whereis                                [ OK ]
[08:32:29]   /usr/bin/which                                  [ OK ]
[08:32:30]   /usr/bin/who                                    [ OK ]
[08:32:30]   /usr/bin/whoami                                 [ OK ]
[08:32:31]   /usr/bin/gawk                                   [ OK ]
[08:32:31]   /usr/bin/tcsh                                   [ OK ]
[08:32:32]   /usr/bin/kmod                                   [ OK ]
[08:32:32]   /usr/bin/mailx                                  [ OK ]
[08:32:33]   /usr/bin/systemctl                              [ OK ]
[08:32:33]   /sbin/checkproc                                 [ OK ]
[08:32:34]   /sbin/chkconfig                                 [ OK ]
[08:32:34]   /sbin/depmod                                    [ OK ]
[08:32:35]   /sbin/fsck                                      [ OK ]
[08:32:36]   /sbin/ifconfig                                  [ OK ]
[08:32:36]   /sbin/ifdown                                    [ OK ]
[08:32:36]   /sbin/ifstatus                                  [ OK ]
[08:32:37]   /sbin/ifup                                      [ OK ]
[08:32:37]   /sbin/init                                      [ OK ]
[08:32:38]   /sbin/insmod                                    [ OK ]
[08:32:38]   /sbin/ip                                        [ Warning ]
[08:32:38] Warning: The file properties have changed:
[08:32:38]          File: /sbin/ip
[08:32:38]          Current inode: 737822    Stored inode: 148475
[08:32:39]   /sbin/lsmod                                     [ OK ]
[08:32:39]   /sbin/modinfo                                   [ OK ]
[08:32:40]   /sbin/modprobe                                  [ OK ]
[08:32:40]   /sbin/nologin                                   [ OK ]
[08:32:41]   /sbin/rmmod                                     [ OK ]
[08:32:41]   /sbin/route                                     [ OK ]
[08:32:42]   /sbin/runlevel                                  [ OK ]
[08:32:43]   /sbin/sysctl                                    [ OK ]
[08:32:45]   /usr/sbin/cron                                  [ OK ]
[08:32:45]   /usr/sbin/depmod                                [ OK ]
[08:32:46]   /usr/sbin/fsck                                  [ OK ]
[08:32:47]   /usr/sbin/groupadd                              [ OK ]
[08:32:47]   /usr/sbin/groupdel                              [ OK ]
[08:32:47]   /usr/sbin/groupmod                              [ OK ]
[08:32:48]   /usr/sbin/grpck                                 [ OK ]
[08:32:48]   /usr/sbin/ifup                                  [ OK ]
[08:32:49]   /usr/sbin/insmod                                [ OK ]
[08:32:49]   /usr/sbin/ip                                    [ Warning ]
[08:32:49] Warning: The file properties have changed:
[08:32:49]          File: /usr/sbin/ip
[08:32:49]          Current inode: 737829    Stored inode: 148482
[08:32:50]   /usr/sbin/lsmod                                 [ OK ]
[08:32:51]   /usr/sbin/modinfo                               [ OK ]
[08:32:51]   /usr/sbin/modprobe                              [ OK ]
[08:32:52]   /usr/sbin/nologin                               [ OK ]
[08:32:53]   /usr/sbin/pwck                                  [ OK ]
[08:32:53]   /usr/sbin/rmmod                                 [ OK ]
[08:32:54]   /usr/sbin/sshd                                  [ OK ]
[08:32:55]   /usr/sbin/sulogin                               [ OK ]
[08:32:55]   /usr/sbin/sysctl                                [ OK ]
[08:32:56]   /usr/sbin/useradd                               [ OK ]
[08:32:56]   /usr/sbin/userdel                               [ OK ]
[08:32:57]   /usr/sbin/usermod                               [ OK ]
[08:32:57]   /usr/sbin/vipw                                  [ OK ]
[08:32:58]   /usr/sbin/xinetd                                [ OK ]
[08:33:14]   /usr/lib/systemd/systemd                        [ OK ]
[08:33:15]   /etc/rkhunter.conf                              [ OK ]
[08:33:15]   /etc/rkhunter.d/00-opensuse.conf                [ OK ]
[08:33:20]
[08:33:20] Info: Starting test name 'rootkits'
[08:33:20] Checking for rootkits...
[08:33:20]
[08:33:20] Info: Starting test name 'known_rkts'
[08:33:20] Performing check of known rootkit files and directories
[08:33:20]
[08:33:20] Checking for 55808 Trojan - Variant A...
[08:33:20]   Checking for file '/tmp/.../r'                  [ Not found ]
[08:33:20]   Checking for file '/tmp/.../a'                  [ Not found ]
[08:33:20] 55808 Trojan - Variant A                          [ Not found ]
[08:33:20]
[08:33:20] Checking for ADM Worm...
[08:33:20]   Checking for string 'w0rm'                      [ Not found ]
[08:33:20] ADM Worm                                          [ Not found ]
[08:33:20]
[08:33:20] Checking for AjaKit Rootkit...
[08:33:20]   Checking for file '/dev/tux/.addr'              [ Not found ]
[08:33:20]   Checking for file '/dev/tux/.proc'              [ Not found ]
[08:33:21]   Checking for file '/dev/tux/.file'              [ Not found ]
[08:33:21]   Checking for file '/lib/.libgh-gh/cleaner'      [ Not found ]
[08:33:21]   Checking for file '/lib/.libgh-gh/Patch/patch'  [ Not found ]
[08:33:21]   Checking for file '/lib/.libgh-gh/sb0k'         [ Not found ]
[08:33:21]   Checking for directory '/dev/tux'               [ Not found ]
[08:33:21]   Checking for directory '/lib/.libgh-gh'         [ Not found ]
[08:33:21] AjaKit Rootkit                                    [ Not found ]
[08:33:21]
[08:33:21] Checking for Adore Rootkit...
[08:33:21]   Checking for file '/usr/secure'                 [ Not found ]
[08:33:21]   Checking for file '/usr/doc/sys/qrt'            [ Not found ]
[08:33:21]   Checking for file '/usr/doc/sys/run'            [ Not found ]
[08:33:21]   Checking for file '/usr/doc/sys/crond'          [ Not found ]
[08:33:22]   Checking for file '/usr/sbin/kfd'               [ Not found ]
[08:33:22]   Checking for file '/usr/doc/kern/var'           [ Not found ]
[08:33:22]   Checking for file '/usr/doc/kern/string.o'      [ Not found ]
[08:33:22]   Checking for file '/usr/doc/kern/ava'           [ Not found ]
[08:33:22]   Checking for file '/usr/doc/kern/adore.o'       [ Not found ]
[08:33:22]   Checking for file '/var/log/ssh/old'            [ Not found ]
[08:33:22]   Checking for directory '/lib/security/.config/ssh' [ Not found ]
[08:33:22]   Checking for directory '/usr/doc/kern'          [ Not found ]
[08:33:22]   Checking for directory '/usr/doc/backup'        [ Not found ]
[08:33:22]   Checking for directory '/usr/doc/backup/txt'    [ Not found ]
[08:33:22]   Checking for directory '/lib/backup'            [ Not found ]
[08:33:22]   Checking for directory '/lib/backup/txt'        [ Not found ]
[08:33:22]   Checking for directory '/usr/doc/work'          [ Not found ]
[08:33:23]   Checking for directory '/usr/doc/sys'           [ Not found ]
[08:33:23]   Checking for directory '/var/log/ssh'           [ Not found ]
[08:33:23]   Checking for directory '/usr/doc/.spool'        [ Not found ]
[08:33:23]   Checking for directory '/usr/lib/kterm'         [ Not found ]
[08:33:23] Adore Rootkit                                     [ Not found ]
[08:33:23]
[08:33:23] Checking for aPa Kit...
[08:33:23]   Checking for file '/usr/share/.aPa'             [ Not found ]
[08:33:23] aPa Kit                                           [ Not found ]
[08:33:23]
[08:33:23] Checking for Apache Worm...
[08:33:23]   Checking for file '/bin/.log'                   [ Not found ]
[08:33:23] Apache Worm                                       [ Not found ]
[08:33:23]
[08:33:23] Checking for Ambient (ark) Rootkit...
[08:33:23]   Checking for file '/usr/lib/.ark?'              [ Not found ]
[08:33:23]   Checking for file '/dev/ptyxx/.log'             [ Not found ]
[08:33:23]   Checking for file '/dev/ptyxx/.file'            [ Not found ]
[08:33:23]   Checking for file '/dev/ptyxx/.proc'            [ Not found ]
[08:33:24]   Checking for file '/dev/ptyxx/.addr'            [ Not found ]
[08:33:24]   Checking for directory '/dev/ptyxx'             [ Not found ]
[08:33:24] Ambient (ark) Rootkit                             [ Not found ]
[08:33:24]
[08:33:24] Checking for Balaur Rootkit...
[08:33:24]   Checking for file '/usr/lib/liblog.o'           [ Not found ]
[08:33:24]   Checking for directory '/usr/lib/.kinetic'      [ Not found ]
[08:33:24]   Checking for directory '/usr/lib/.egcs'         [ Not found ]
[08:33:24]   Checking for directory '/usr/lib/.wormie'       [ Not found ]
[08:33:24] Balaur Rootkit                                    [ Not found ]
...........................................

[19:21:51] Info: Starting test name 'system_configs'
[19:21:51] Performing system configuration file checks

[19:22:57]
[19:22:57] Info: End date is mié jul  1 19:22:57 CEST 2015