Chkrootkit output passwd infected

If you’re seeing output from your chkrootkit that says something like: Checking `passwd'… INFECTED And maybe (at the bottom): INFECTED (PORTS: 465) There’s a good change it’s a false positive but you need to check. The way to check is see if the md5sum of your current passwd file matches the one distributed by CPanel.