chkrootkit 0.48

chkrootkit is a free and open source security tool to locally check for signs of a rootkit.
chkrootkit has been tested on: Mac OS X, Linux 2.0.x, 2.2.x, 2.4.x and 2.6.x, FreeBSD 2.2.x, 3.x, 4.x and 5.x, NetBSD 1.6.x, OpenBSD 2.x, 3.x and 4.x., Solaris 2.5.1, 2.6, 8.0 and 9.0, HP-UX 11, Tru64, and BSDI.
chkrootkit comes with the following tools:
- chkrootkit: shell script that checks system binaries for rootkit modification.
- ifpromisc.c: checks if the interface is in promiscuous mode.
- chklastlog.c: checks for lastlog deletions.
- chkwtmp.c: checks for wtmp deletions.
- check_wtmpx.c: checks for wtmpx deletions. (Solaris only)
- chkproc.c: checks for signs of LKM trojans.
- chkdirs.c: checks for signs of LKM trojans.
- strings.c: quick and dirty strings replacement.
- chkutmp.c: checks for utmp deletions.

Enhancements
- new tests: common SSH brute force scanners, suspicious PHP files
- enhanced tests: login, netstat, top, backdoor
- some minor bug fixes