My system is an up-to-date Ubuntu 13.10
I've installed Tiger and I'm getting this
# Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... OLD: --ALERT-- [rootkit005a] Chkrootkit has found a file which seems to be infected because of a rootkit OLD: --ALERT-- [rootkit009a] A rootkit seems to be installed in the system OLD: INFECTED (PORTS: 60001)
I've also tried rkhunter: doesn't really find anything directly, here's the assorted warnings
/usr/bin/unhide.rb [ Warning ] Checking for passwd file changes [ Warning ] Checking for group file changes [ Warning ] Checking /dev for suspicious file types [ Warning ] Checking for hidden files and directories [ Warning ]
There's also the suckit thing (described in another thread here http://ubuntuforums.org/showthread.php?t=1680428), but that's been ruled out as a bug.
There's nothing on this port there, well not now anyway.
How do I verify this? How do I go about it??