Today I found this email. Mail quantity sent is ok (normal as usual), lsof and netstat doesn't show anythin using port 47018, rkhunter is ok, chkrootkit is ok, timestamp of this dir has not been modified... is this a false alarm? could some one guide me if I have to check something else?
Warning: Network TCP port 47018 is being used by /usr/lib/postfix/smtpd. Possible rootkit: Possible Universal Rootkit (URK) component
Use the 'lsof -i' or 'netstat -an' command to check this.
One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)