https://servidordebian.org/pt/lenny/security/rootkit_detection/start
7.2 Detecção de rootkits