On 2010-09-05 09:32 +0200, Chris wrote: > Odd though, my which resides in /usr/bin opposed to your /bin. > This could be a difference from your Deb 5 and my Sid though. It's probably just a difference in the PATH variable: the which program is installed into /bin with a compatibility symlink in /usr/bin. It should also be noted that many of rkhunter's warnings are just bogus. For instance, /usr/bin/ldd has been a script for ages. Sven