[colug-432] Necropsy: Virus?

[R P Herrold]

On Tue, 3 May 2011, jep200404 at columbus.rr.com wrote:

> What non-malicious reasons can there be for a new version of a
> program to have the same size and timestamp as an old version,
> yet have different md5sums?

the cron based, library 'prelinking' does this --- rpm knows 
how to reverse when it rpm -V (packagename) -- tripwire does 
not, aide does (as I recall)

- Russ herrold