rkhunter found 6 possible rootkits & how to remove them
That probably aren't rootkits, just unrecognized files by rkhunter, false positives. To be on the safe side, you can remove what you don't use.
In the case of the cisco files:
/dev/shm/sem.CiscoAcNamedEventOpenDNS: data
/dev/shm/sem.CiscoAcNamedEventNVM: data
/dev/shm/sem.CiscoAcMemoryLock: data
seems to be the files used by a previous cisco anyconnect install.
Check if you have any instance running, e.g.:
ps -ef|grep vpn
You can probably see a process running like:
root 5968 1 0 ago14 ? 00:00:00 /opt/cisco/anyconnect/bin/vpnagentd
It can be uninstalled by running:
/opt/cisco/vpn/bin/vpn_uninstall.sh
/opt/cisco/anyconnect/bin/vpn_uninstall.sh
/opt/cisco/anyconnect/bin/anyconnect_uninstall.sh