Chkrootkit is a tool that checks for signs of a local root-kit. The tool includes detection for LKM rootkits, ifpromisc.c (to check and see if an interface has been set in promiscuous mode), chklastlog.c (to check lastlog for deletions) and chkwtmp.c (to check wtmp for deletions).
The tool has been tested on:
* Linux
* FreeBSD
* Solaris
* OpenBSD