[colug-432] Necropsy: Virus?: maybe cron prelink

jep200404 at columbus.rr.com jep200404 at columbus.rr.com
Tue May 3 21:54:26 EDT 2011

R P Herrold <herrold at owlriver.com> wrote:

> On Tue, 3 May 2011, jep200404 at columbus.rr.com wrote:
> > What non-malicious reasons can there be for a new version of a
> > program to have the same size and timestamp as an old version,
> > yet have different md5sums?
> the cron based, library 'prelinking' does this --- rpm knows 
> how to reverse when it rpm -V (packagename) -- tripwire does 
> not, aide does (as I recall)

Russ, Thanks for answering the question asked 
and giving me a clue where to look. 

More information about the colug-432 mailing list