If you are having to detect a rootkit after the fact, without tripwire installed, you have pretty much already lost. The entire idea of a rootkit is too seamlessly blend into the underlying OS and to hide itself from detection. Since you don't have tripwire installed, I would recommend building a new copy of what you have trying to match it as closely as possible and then comparing the differences in file sizes, dates of creation, processes running, etc.

There are some helpful tools at : http://www.incident-response.org/unix.html

But be mindful, just because you have run tools and they didn't find anything does not mean that you have not had a rootkit installed. It is still possible one is installed, it is just very good at hiding itself (through kernel mods, etc).

Neb