check for Umbreon rootkit