Hmm, go to http://www.chkrootkit.org/ and get chkrootkit and run it. Just to be sure, although, i think that tedob has hit the point here. Ive not seen an understandable answer here to what tedob has said. Are you scanning the boxes in the internal network, using the internal lan ip, or the real ip?? It would help to understand your network setup a bit better.

Cheers.