$ sudo chkrootkit
(...)
Searching for suspicious files and dirs, it may take a while... The following
suspicious files and directories were found:
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/noentry/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htaccess
/usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd
/usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit
/usr/lib/jvm/.java-1.8.0-openjdk-amd64.jinfo /usr/lib/debug/.build-id
/lib/modules/4.4.0-142-generic/vdso/.build-id
/lib/modules/4.4.0-143-generic/vdso/.build-id
/lib/modules/4.4.0-141-generic/vdso/.build-id
/lib/modules/4.4.0-138-generic/vdso/.build-id
/usr/lib/debug/.build-id /lib/modules/4.4.0-142-generic/vdso/.build-id
/lib/modules/4.4.0-143-generic/vdso/.build-id
/lib/modules/4.4.0-141-generic/vdso/.build-id
/lib/modules/4.4.0-138-generic/vdso/.build-id
(...)
Searching for Linux/Ebury - Operation Windigo ssh... Possible
Linux/Ebury - Operation Windigo installetd
(...)
