chkrootkit review

chkrootkit is not antivirus in the usual sense, and it belongs here only as a companion. It is a shell script plus a handful of small C programs that look locally for signs of a rootkit: modified system binaries, network interfaces in promiscuous mode, deleted lastlog, wtmp and utmp entries, and signs of kernel module trojans. The project has been running for 25 years and is still updated. Version 0.59, released on January 1, 2026, added checks for processes executed from memory, the XZ backdoor and the Bootkitty UEFI bootkit, and the homepage lists 75 rootkits, worms and backdoors it detects. Running it takes one command, and it fits well in a weekly cron job next to ClamAV. It does not scan your downloads for viruses or block anything as you work, and its output assumes you know what a normal system looks like, so treat a warning as a reason to investigate rather than proof of infection.

Who it is for

Linux users who want a free, quick rootkit check to run next to a regular antivirus scanner.

Price

Free software, funded by donations.

Chkrootkit is free software.
Quoted from the vendor pricing page on November 10, 2026.

Key features

• Checks system binaries for rootkit modification
• Detects interfaces in promiscuous mode
• Checks for lastlog, wtmp and utmp deletions
• Looks for signs of LKM trojans
• Version 0.59 adds checks for processes executed from memory, the XZ backdoor and the Bootkitty UEFI bootkit

Strengths and weaknesses

• Strength: Free and still updated, with version 0.59 released January 1, 2026
• Strength: Lists 75 rootkits, worms and backdoors it detects
• Strength: Runs from the terminal or cron with no daemon
• Weakness: Not a general antivirus and does not scan files for viruses
• Weakness: No on-access protection
• Weakness: Results need some Linux knowledge to read

Key facts

• Latest version: 0.59, released January 1, 2026
• Tested on: Linux 2.0.x to 5x, BSDs, Solaris, HP-UX, Mac OS X
• Listed detections: 75 rootkits, worms and backdoors
• License: Free software

Where it ranks

chkrootkit is No. 9 in our Best Antivirus for Linux verdict.