As part of my job, I've done a fair amount of work on detecting rootkits, though I've mainly been working with detecting the kernel module rootkits. But as far as normal rootkits go, everyone has had lots of good things to say about chkrootkit, so that's probably your best bet. I hope you're good with C, because some (most?) of these programs take some tweaking to get them to work right with more modern kernels. Good luck.