From x terminal: ps

And to list ip connections and listening processes, as root: lsof -i

Although a rootkit will probably hide itself so you wouldn't see it by using these commands anyway.

A more user friendly way of examining running processes is htop (available in one of the repositories). You can scroll through the list of processes and kill the ones you don't like the look of (be careful!)

As far as I understood, there is no way at all to discover a rootkit on n900, isn't it?

There are rootkit detection and related packages for Linux (e.g. chkrootkit, tripwire etc), but I've not seen any of them ported to the N900.

The last time I was looking for tripwire I did not find a newer
and free release.
Found AIDE
http://www.cs.tut.fi/~rammer/aide.html
instead.

Now I see that there is
http://sourceforge.net/projects/tripwire/
with "Release Date: 2010-03-11"
Did anybody check this on a Linux system (not necessarily N900)?

Doing a "clean boot" is kinda hard without reflashing the whole firmware. tripwire requires a known-good configuration to check against and I'm fairly sure a proper rootkit can fool it pretty easily (it's been a while but AFAIRecall tripwire only checks against file hashes and proper rootkit can hide all modifications [see below]).

As for windows not having root user, it does have admin user and privilege separation etc so getting stuck with what the superuser happens to be called is kinda pointless.

Besides rootkit these days refers to a program that hides it's presence in the system (by patching itself to filter things like process list and disk access and simply serving "clean" versions to any other process that asks). Rhus a clean boot (from known-good CD for example) is needed so that the unpatched view of system can be gained, this can then be compared to what the normally booted system looks like (explanation simplified, see "lies to children").

F-Secure (I used to work for them about 9yrs ago) has a tool called Blacklight for detecting rootkits, read the white papers if you want to know more.