Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Install rkhunter from Ubuntu’s package repository, update its detection data, create a file-property baseline only after verifying that the VPS is trustworthy, and then run regular checks with preserved logs. Treat every warning as an investigation lead rather than proof of a rootkit: package upgrades, deployments, and normal configuration changes can alter files that rkhunter watches.
The safe operating sequence is apt install → verify the host → rkhunter --propupd once → rkhunter --update → rkhunter --check → investigate and document warnings. Never run --propupd automatically to make an unexplained warning disappear.
Recommended Free Tools
What rkhunter does on an Ubuntu VPS
RootKit Hunter (rkhunter) is a shell script and command-line detector for Unix-like systems. It looks for known rootkits and unwanted tools, checks whether monitored files have changed, examines startup files, and looks for suspicious conditions such as unexpected listening applications on network interfaces. Its output is a report for an administrator; it is not a mathematical proof that a server is clean and it does not explain the cause of every change it finds.
That distinction matters on a VPS. A legitimate Ubuntu package upgrade can replace binaries, alter permissions, or change timestamps. A deployment can add a startup entry or a service that rkhunter has not seen before. A warning therefore tells you where to look, not what the final diagnosis is.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
What the checks cover
- Known rootkits and files or tools associated with them.
- Properties of selected files, compared with a locally stored baseline.
- Startup files and entries that could cause code to run at boot or login.
- Network conditions, including applications listening on interfaces.
- Other heuristic checks that rkhunter reports as warnings when they differ from its expectations.
What rkhunter cannot establish by itself
- It cannot prove that no rootkit or other compromise exists.
- It cannot determine whether a changed file came from a legitimate deployment, an Ubuntu update, or an attacker without your investigation.
- It does not replace patching, SSH hardening, least-privilege administration, backups, access logging, or an incident-response plan.
- It cannot establish the full scope of an intrusion or guarantee eradication after a compromise.
Prepare the VPS before installing
Run the commands as an administrator through a trusted SSH session or your provider’s console. Make sure you have a current backup and a way to access the VPS if an SSH configuration change locks you out. The scan is most useful when you can correlate its findings with package changes, deployments, and account activity.
Preparation checklist
- Confirm the VPS is fully patched or record which updates are waiting.
- Write down recent deployments, kernel changes, service installations, and configuration edits.
- Check who has administrative access and remove credentials that are no longer needed.
- Ensure logs are retained somewhere you can review even if the VPS later becomes unavailable.
- Decide who will investigate a warning and what your isolation procedure is.
Do not create a baseline while an unexplained incident is in progress. A baseline records the current state; it does not decide whether that state is good.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install rkhunter from Ubuntu’s repository
Refresh the package index and install the package with apt:
sudo apt update
sudo apt install rkhunterRead any package prompts and inspect the installed configuration before scanning. The package installation supplies the command and its default configuration, but your VPS may already contain local changes that affect what is checked or ignored.
Confirm that the command is available
After installation, ask rkhunter to show its help or version output:
rkhunter --helpIf the command is not found, check that the package installation completed successfully and that you are invoking the command in the administrator’s environment. Do not copy a binary from another server to work around a failed package installation; repair the package state and investigate why it failed.
Create a trusted file-property baseline with --propupd
rkhunter compares selected file properties against a baseline. Create or refresh that baseline with:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo rkhunter --propupdThis command records the properties that rkhunter will use for later comparisons. It does not scan the VPS and it does not certify the files. The administrator is responsible for confirming that the files are genuine before accepting them as the baseline.
When to run it
- Run it after a clean installation when you have verified the installed packages and configuration.
- Run it after reviewing a legitimate operating-system or package change and confirming which monitored files were expected to change.
- Run it after a documented deployment that intentionally replaces or adds monitored files.
When not to run it
- Do not run it automatically after every scan.
- Do not run it simply because a warning is inconvenient or because you want a green report.
- Do not run it while an unknown binary, account, startup entry, or network listener is still unexplained.
If an attacker has modified a monitored file, --propupd would bless that malicious state as the new reference. The correct response to an unexplained change is investigation and, when appropriate, isolation—not a baseline refresh.
Update rkhunter’s data files
Refresh rkhunter’s text data files with:
sudo rkhunter --updateThe update operation checks for newer data and installs it when available. The documented update path requires a command-line web browser such as wget or lynx. If the update fails, read the error, verify outbound connectivity and name resolution, and confirm that the required command-line browser is installed. Do not treat a failed update as evidence that the VPS is infected; it means the scanner may be using older data and the result deserves qualification.
Run updates before scheduled checks, but keep the two operations logically separate so you can tell whether a problem came from downloading data or from the scan itself.
Run a scan and preserve the log
Start the checks with:
sudo rkhunter --checkrkhunter displays each test and writes a log at /var/log/rkhunter.log. Preserve that log as part of your server’s security records:
sudo less /var/log/rkhunter.logThe interactive check may pause for confirmation depending on the installed configuration. Read each result instead of accepting prompts blindly, especially on the first run.
Reduce output for a targeted review
To display only warnings, use:
sudo rkhunter --check --report-warnings-onlyThis is useful after you have retained the complete log. A warnings-only view is not a substitute for the full report because normal results provide context about what was tested.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
For cron or other machine-collected output, suppress color control characters:
sudo rkhunter --check --nocolorsUse --nocolors when redirecting output to a file or feeding it to an alerting system; otherwise escape sequences can make parsing and reading harder.
Validate configuration and local exceptions
After editing rkhunter’s configuration, validate the result:
sudo rkhunter --config-checkrkhunter supports its main rkhunter.conf, a same-directory rkhunter.conf.local, and an rkhunter.d directory containing local .conf fragments. Keep local changes separate from package-managed defaults where practical so upgrades are easier to review.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Use whitelists narrowly
Whitelist a path only after independently confirming that it is legitimate, expected, and owned by the package or deployment that should have created it. Record why the exception exists, who approved it, and when it should be revisited. A broad ignore rule can hide a future change in the same location, so prefer the narrowest path or condition that solves a known false positive.
How to investigate warnings
A warning is a lead, not a verdict. Start by identifying exactly what rkhunter flagged and then correlate it with trusted administrative records.
| Warning or symptom | First checks | Safe next action |
|---|---|---|
| Changed file properties | Compare the file with the owning Ubuntu package; review recent package updates and deployments; inspect permissions, owner, and timestamps. | Document the legitimate change, then refresh the baseline only after verification. If the change is unexplained, preserve evidence and escalate. |
| Unknown binary or suspicious tool | Record its path, hash, owner, timestamps, process use, and how it arrived on the host. | Do not delete it immediately. Isolate the VPS if compromise is plausible and preserve disk and log evidence. |
| Unexpected startup entry | Identify the service or script, its package or deployment owner, execution user, and recent changes. | Disable or contain it only within your incident process; retain a copy and the relevant logs first. |
| Unexplained account or privilege change | Review account creation, group membership, SSH keys, sudo rules, and authentication logs. | Rotate credentials from a clean device and investigate all administrative access. |
| Unexpected network listener | Map the listening socket to its process and service, then check its package, configuration, bind address, and deployment history. | Restrict exposure through the provider or firewall while determining whether the listener is authorized. |
Correlate before you suppress
Use your package records, deployment records, and apt history to explain a changed file. A first run commonly produces expected warnings because the local baseline and rkhunter’s expectations have not yet been reconciled with the VPS’s actual software. Explain each warning in your notes and rerun the check after the legitimate change is understood. Do not silence a warning merely to make the report appear clean.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
What to do when a compromise is plausible
If a warning concerns an unknown executable, an unexpected startup mechanism, an unexplained account, or a listener that you cannot attribute, switch from routine scanning to incident response.
- Use your VPS provider’s controls to isolate the machine from the network, while preserving the access channel required for evidence collection.
- Preserve rkhunter’s log, authentication records, package and deployment records, and relevant disk evidence. Record times in a consistent timezone.
- Rotate passwords, API keys, SSH keys, and other credentials from a known-clean device. Assume credentials present on the VPS may have been exposed.
- Determine the likely entry point and scope. Check other systems that shared credentials, images, backups, or deployment pipelines.
- Follow your organization’s incident-response process. Rebuild from a known-good image when trust in the operating system cannot be restored; do not rely on rkhunter alone to eradicate an intrusion.
A clean-looking rerun after deleting a suspicious file does not prove that persistence, stolen credentials, or other modified components are absent.
Automate scans without destroying evidence
rkhunter can run from cron, but automation should collect evidence and alert on new findings rather than overwrite uncertainty. Schedule data updates and checks as separate operations or in a controlled sequence. Capture the exit status, retain /var/log/rkhunter.log, and use --nocolors for machine-readable output.
Example controlled sequence
sudo rkhunter --update
sudo rkhunter --check --nocolorsPlace this sequence in your normal job scheduler only after testing it interactively. Have the job write its output to your central log destination and send an alert when a new warning appears. Alerting on every historical warning creates noise and encourages operators to ignore the system.
Rules for a safe scheduled job
- Never include
rkhunter --propupdin an unattended job. - Keep the complete log and the job’s exit status, not only a one-line success message.
- Make the update result visible; a scan performed with stale data should be identified as such.
- Test the alert path with a controlled, documented condition before relying on it.
- Review the baseline after every legitimate operating-system or package change.
The exact cron interval should match your change rate and response capacity. A daily check that nobody reviews is less useful than a less frequent check with reliable alerting and an assigned owner.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Maintain the baseline after legitimate changes
Operating-system updates, package installation, kernel changes, and deployments can all alter monitored files. Use this change procedure:
- Record the planned change and the expected files, services, and startup entries it may affect.
- Apply the change through your normal, auditable process.
- Run a check and review warnings against the change record.
- Investigate anything outside the expected set.
- Only after the host is trusted, run
sudo rkhunter --propupdto establish the new reference. - Run another check and retain both the change record and the resulting log.
This turns baseline maintenance into a controlled security action rather than a routine attempt to clear alerts.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Where rkhunter fits with other security controls
Choose controls by the type of evidence you need. rkhunter is strongest as a lightweight detector and reporting aid; it is not a complete behavioral-monitoring or response platform.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Control characteristic | rkhunter | What another control may add |
|---|---|---|
| Detection scope | Known rootkits and unwanted tools, file-property changes, startup checks, and suspicious network conditions. | Behavioral monitoring can observe process, file, authentication, or network activity that is not in a known signature set. |
| Baseline maintenance | Requires a trusted baseline and deliberate updates after legitimate changes. | Some systems maintain baselines centrally or learn expected behavior, but they still need change awareness. |
| False-positive handling | Requires package, deployment, and host investigation; local exceptions must be narrow. | Central correlation can add context, but no tool removes the need for human validation. |
| Automation and alerting | Runs from cron; logs and exit status must be collected and new warnings differentiated from old ones. | Monitoring or security operations systems can aggregate alerts and assign response ownership. |
| VPS resource cost | Command-line scans are suitable for a VPS when scheduled and reviewed responsibly. | Continuous agents may provide broader visibility but consume additional resources and require their own maintenance. |
| Response after a finding | Reports a lead; it does not isolate, investigate scope, or rebuild the host. | Incident-response tooling and procedures provide containment, evidence handling, credential rotation, and recovery. |
Surround rkhunter with timely patching, SSH hardening, least privilege, reliable backups, centralized logging where possible, and a tested incident-response plan.
Common problems and recovery steps
The update command cannot download data
Verify that the VPS can resolve names and reach the update service, then check whether wget or lynx is installed as required by the documented command-line update path. Read the command output and retry after correcting the dependency or network policy. Record that the scan used old data if you proceed before a successful update.
The first scan reports many warnings
Do not refresh the baseline immediately. Review each warning against package upgrades, initial server provisioning, deployments, and expected listening services. First-run differences are common; explain legitimate items, correct configuration where needed, and escalate anything that remains unexplained.
A warning returns after every scan
Determine whether the underlying file or setting is intentionally changing. If it is legitimate, document the reason and add the narrowest justified local configuration exception. If it is not legitimate, treat the recurrence as evidence that the cause has not been resolved rather than repeatedly updating the baseline.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe report is difficult to parse in cron mail
Run the check with --nocolors, retain the full log, and have your alerting logic compare newly observed warnings with a stored, reviewed history. Keep an operator-readable copy so an abbreviated alert does not remove context.
Configuration edits produce unexpected behavior
Run sudo rkhunter --config-check after edits. Review rkhunter.conf, rkhunter.conf.local, and files under rkhunter.d for conflicting or overly broad settings. Remove an exception that you cannot justify.
Operational checklist
- Install with
sudo apt updateandsudo apt install rkhunter. - Verify the VPS, its packages, recent changes, accounts, and expected services before baselining.
- Create a trusted baseline with
sudo rkhunter --propupdonly after verification. - Refresh data with
sudo rkhunter --update; ensure a supported command-line browser is available. - Scan with
sudo rkhunter --checkand preserve/var/log/rkhunter.log. - Use
--report-warnings-onlyfor focused review and--nocolorsfor cron output. - Validate configuration with
sudo rkhunter --config-checkafter edits. - Investigate warnings against package, deployment, permission, timestamp, account, and network evidence.
- Isolate and preserve evidence when a binary, startup entry, account, or listener remains unexplained.
- Automate updates and checks, but never automate
--propupd.
Bottom line
rkhunter is useful when you operate it as a disciplined evidence-gathering step: establish a known-good baseline, keep detection data current, scan regularly, preserve logs, and investigate changes in context. Its warnings deserve attention, but only a broader investigation can determine whether an Ubuntu VPS is compromised and what recovery is safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
