[colug-432] Necropsy: Virus?: maybe cron prelink

[jep200404 at columbus.rr.com]

R P Herrold <herrold at owlriver.com> wrote:

> On Tue, 3 May 2011, jep200404 at columbus.rr.com wrote:
> 
> > What non-malicious reasons can there be for a new version of a
> > program to have the same size and timestamp as an old version,
> > yet have different md5sums?
> 
> the cron based, library 'prelinking' does this --- rpm knows 
> how to reverse when it rpm -V (packagename) -- tripwire does 
> not, aide does (as I recall)

Russ, Thanks for answering the question asked 
and giving me a clue where to look.