rkhunter found 6 possible rootkits & how to remove them

That probably aren't rootkits, just unrecognized files by rkhunter, false positives. To be on the safe side, you can remove what you don't use.

In the case of the cisco files:

/dev/shm/sem.CiscoAcNamedEventOpenDNS: data
/dev/shm/sem.CiscoAcNamedEventNVM: data
/dev/shm/sem.CiscoAcMemoryLock: data

seems to be the files used by a previous cisco anyconnect install.

Check if you have any instance running, e.g.:

ps -ef|grep vpn

You can probably see a process running like:

root        5968       1  0 ago14 ?        00:00:00  /opt/cisco/anyconnect/bin/vpnagentd

It can be uninstalled by running:

/opt/cisco/vpn/bin/vpn_uninstall.sh
/opt/cisco/anyconnect/bin/vpn_uninstall.sh
/opt/cisco/anyconnect/bin/anyconnect_uninstall.sh