I patched my kernel this new grsec patch.
And this is result of rkhunter scan:
Checking binaries
* Selftests
Strings (command) [ OK ]
* System tools
Info: prelinked files found
Performing 'known good' check...
/usr/bin/find [ OK ]
/sbin/ifconfig [ OK ]
/usr/bin/watch [ BAD ]
/usr/bin/w [ BAD ]
/usr/bin/whoami [ OK ]
/usr/bin/who [ OK ]
/usr/bin/users [ OK ]
/usr/bin/stat [ OK ]
/usr/bin/sha1sum [ OK ]
/usr/bin/kill [ OK ]
/usr/bin/find [ OK ]
/usr/bin/file [ OK ]
/usr/bin/pstree [ OK ]
/usr/bin/killall [ OK ]
/usr/bin/lsattr [ OK ]
/bin/mount [ OK ]
/bin/netstat [ OK ]
/bin/egrep [ BAD ]
/bin/fgrep [ BAD ]
/bin/grep [ BAD ]
/bin/cat [ OK ]
/bin/chmod [ OK ]
/bin/chown [ OK ]
/bin/env [ OK ]
/bin/ls [ OK ]
/bin/su [ OK ]
/bin/ps [ BAD ]
/bin/dmesg [ OK ]
/bin/kill [ OK ]
/bin/login [ OK ]
/sbin/chkconfig [ OK ]
/sbin/depmod [ OK ]
/sbin/insmod [ OK ]
/sbin/modinfo [ OK ]
/sbin/sysctl [ BAD ]
/sbin/syslogd [ BAD ]
/sbin/init [ OK ]
/sbin/runlevel [ OK ]
/usr/sbin/prelink: "/usr/bin/groups" is not an ELF file
/usr/bin/groups [ OK ]
/sbin/ip [ OK ]