Comment 2 for bug 2024582

It's completely normal for programs to use shared memory segments. That's why they're there! :) rkhunter reports them because they're persistent like the filesystem but not really visible, unlike the filesystem. You have to know to look for them.

rkhunter is a tool for you to use as part of your investigation. I'm very skeptical of its value in general but you absolutely cannot just use its output as proof of anything nefarious.

Thanks