Nicely done [member=411]bitsnpcs[/member]
The first lib command you cite is enough to know whether or not ebury is installed.
TC
If these are real rootkits, would a Linux antivirus software "clean" the problem? (rootkits are not always cleaned by default on Window's AV

) . Ralated but curving the OP a bit, what would be the "Avira" for Linux ? (i.e. free and good). -TD
[member=5916]trinidad[/member] Thank You, it is very good to know the first one is enough
(11-16-2017, 07:32 PM)bitsnpcs link Wrote: [ -> ]Thank You for answering and explaining it to me 
You are welcome.
One reason I love Linux is I never have to worry about all this virus/rootkit stuff.