chkrootkit -- locally checks for signs of a rootkit

Linux Security Cookbook, published by O'Reilly, by Daniel J. Barrett, Robert G. Byrnes and Richard Silverman. chkrootkit is mentioned on chapter 9.
Security Warrior, published by O'Reilly, by Anton Chuvakin and Cyrus Peikari. chkrootkit is mentioned on chapter 10 and chapter 19.
Network Security Hacks, published by O'Reilly, by Andrew Lockhart. hack #99 shows how to use chkrootkit to determine the extent of a compromise.
Malware: Fighting Malicious Code, published by Prentice Hall PTR, by Ed Skoudis and Lenny Zeltser. chkrootkit is mentioned on chapers 1, 2 and 3.
(German) Intrusion Detection für Linux-Server, by Ralf Spenneberg. chkrootkit is described in chapter 16.
Linux Troubleshooting Bible, by Christopher Negus and Thomas Weeks. chkrootkit is mentioned on chapter 10.

(Portuguese) Métodos para Detecção Local de Rootkits e Módulos de Kernel Maliciosos em Sistemas Unix, Klaus Steding-Jessen e Nelson Murilo, Anais do III Simpósio sobre Segurança em Informática (SSI'2001), (São José dos Campos, SP), pp. 133--139, Outubro de 2001.
[PDF] [ps.gz] [Abstract]
Levine, L., Grizzard, J., and Owen, H, "Application of a Methodology to Characterize Rootkits Retrieved from Honeynets", 5th IEEE Systems, Man and Cybernetics Information Assurance Workshop, pp. 15-21, West Point, New York, June 2004.