See screen shot. How do I correct this without having to go through the whole o/s reload and headaches?

http://img518.imageshack.us/img518/1445/vps1am4.gif
http://img466.imageshack.us/img466/7623/vps2ea0.gif

I have a VPS with Interworx panel. The above is rkhunter results. Chkrootkit showed nothing

Backup all your data and reinstall. There's no way to get an "untrusted" system back to "trusted" other than reinstalling the OS from scratch. Carefully examine all the data you backed up before restoring it to the new OS. In particular, check for any scripts, binary executables, or any other type of information that could be read through some kind of command interpreter. Once the system is compromised, every piece of information is suspect.

While I too favour serving up ultimate worst-case scenario steps immediately I would suggest first finding out how the damage ocurred. Have a look at the Intruder Detection Checklist (CERT): http://www.cert.org/tech_tips/intrud...checklist.html.

That shows something changed, eg., something new was install, stripped, etc. It does not, in itself, mean you're done in.

Since the supposedly affected binaries are of the kernel modules tools, I'd say someone upgraded the module init tools and forgot about it (or stripped them.) There's also 3 kill's (in coreutils, util-linux, procps ) running around the linux community that I know of right now, depending on what rkhunter is using as it's criteria, it may be being confused by this.

The only thing the above shows for sure is you need to look around a bit more.