Did you try to check the basic setup of the linux system, like users set up in /etc/shadow (is there shadow~ as a backup?) , groups and their permissions, cronjobs for specific users and system users?
Did you try to get chkrootkit from debian repo installed?