[colug-432] Necropsy: Virus?
R P Herrold
herrold at owlriver.com
Tue May 3 20:53:27 EDT 2011
On Tue, 3 May 2011, jep200404 at columbus.rr.com wrote:
> What non-malicious reasons can there be for a new version of a
> program to have the same size and timestamp as an old version,
> yet have different md5sums?
the cron based, library 'prelinking' does this --- rpm knows
how to reverse when it rpm -V (packagename) -- tripwire does
not, aide does (as I recall)
- Russ herrold
More information about the colug-432