You need to ask yourself:
- did I add a user?
- did I install software that might have added a user?
Best method to use is to list the /etc/passwd file on your screen with
and to check for unexpected usernames.
These notices from rkhunter are more than likely caused by an out of date reference file. You might want to do a ...
sudo rkhunter --update
sudo rkhunter --propupd
after you install new software. The 1st creates a new database reference file and the 2nd marks that reference file as a starting point.
If a rootkit is found it is likely to throw more alarms than just a notice regarding
/etc/passwd. That is just a file holding your "users" and it is not enough to start a rootkit.