Wierd thing happened.... my kill does not look ok for some reason...
I got Centos 4.4(upgraded) Plesk 8.0.1 + art + art kernel
Itss md5sum is:

25e5dfd5c8b4deb59c7eb43d1334b110 bin/kill

and rkhunter pops this and only this(nothing else is marked as BAD):

Rootkit Hunter 1.2.9 is running

Determining OS... Ready

Checking binaries
* Selftests
Strings (command) [ OK ]

* System tools
Info: prelinked files found
Performing 'known good' check...
/bin/cat [ OK ]
/bin/chmod [ OK ]
/bin/chown [ OK ]
/bin/date [ OK ]
/bin/dmesg [ OK ]
/bin/env [ OK ]
/bin/grep [ OK ]
/bin/kill [ BAD ]

chkrootkit does not provide with more info... just the usual errors:
Checking `ldsopreload'... can't exec ./strings-static, not tested
Checking `bindshell'... INFECTED (PORTS: 465)
Checking `sniffer'... not tested: can't exec ./ifpromisc
Checking `wted'... not tested: can't exec ./chkwtmp
Checking `z2'... not tested: can't exec ./chklastlog
Checking `chkutmp'... not tested: can't exec ./chkutmp

any suggestions?

Thank you

I had the same thing, hopped on the rkhunter-users mailinglist and found the answer:

http://www.atomicrocketturtle.com/forum ... php?t=1220