Comment 21 for bug 454566

For those similarly affected: I recently reinstalled the upstart package (0.6.5-8) on Lucid (10.04.4) and then received the Suckit [false] flag from chkrootkit 0.49-3 (as well as the version in Debian Wheezy (0.49-4.1)). After restarting the server, the flag disappeared. So, it appears to be sufficient that init is replaced on disk (even by the same version) to trigger the false positive, and that restarting the system will resolve it.