Reveal Rootkit detects processes hidden by rootkits on POSIX systems.
...It is intended to run out of cron or similar services on a regular base and avoids verbose output as long as nothing was found.
It's fast and shouldn't produce false positives.
Reveal RootKit is tested mainly on Linux but should work on other POSIX systems with a /proc filesystem, too.
checkps is a program to detect rootkits by detecting falsified output and
similar anolomies. The ps check should work on anything with /proc, the
(currently incomplete) netstat check is more linux specific