Deteksi rootkit dengan rkhunter

$sudo apt-get install rkhunter
setelah proses installasi selesai kita bisa langsung update data base supaya rkhunter tersebut mempunyai data yang ter update.

$sudo rkhunter --update
[ Rootkit Hunter version 1.3.6 ]

Checking rkhunter data files...
  Checking file mirrors.dat            [ No update ]
  Checking file programs_bad.dat       [ No update ]
  Checking file backdoorports.dat      [ No update ]
  Checking file suspscan.dat           [ No update ]
  Checking file i18n/cn                [ No update ]
  Checking file                        [ No update ]
  Checking file i18n                   [ No update ]
  Checking file i18n/zh                [ No update ]
  Checking file i18n/zh.utf8           [ No update ]

Setelah mengupdate barulah kita melewati tahap yang paling panjang yaitu pengecekannya, perintahnya adalah

[vandy@localhost ~]$ sudo rkhunter -c
[ Rootkit Hunter version 1.3.6 ]

Checking system commands...

  Performing 'strings' command checks
    Checking 'strings' command                 [ OK ]

  Performing 'shared libraries' checks
    Checking for preloading variables     [ None found ]
    Checking for preloaded libraries      [ None found ]
    Checking LD_LIBRARY_PATH variable     [ Not found ]

  Performing file properties checks
    Checking for prerequisites        [ OK ]
    /bin/bash                         [ OK ]
    /bin/cat                          [ OK ]
    /bin/chmod                        [ OK ]
    /bin/chown                        [ OK ]
    /bin/cp                           [ OK ]
    /bin/date                         [ OK ]
    /bin/df                           [ OK ]
    

The system checks took: 2 minutes and 11 seconds

All results have been written to the log file (/var/log/rkhunter.log)

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)

Diatas adalah hasil pemeriksaan system dengan rkhunter.