[colug-432] Necropsy: Virus?

R P Herrold herrold at owlriver.com
Tue May 3 20:53:27 EDT 2011

On Tue, 3 May 2011, jep200404 at columbus.rr.com wrote:

> What non-malicious reasons can there be for a new version of a
> program to have the same size and timestamp as an old version,
> yet have different md5sums?

the cron based, library 'prelinking' does this --- rpm knows 
how to reverse when it rpm -V (packagename) -- tripwire does 
not, aide does (as I recall)

- Russ herrold

More information about the colug-432 mailing list