Wire tripped

[jludwig]

On Thursday 06 October 2005 08:58, Scot L. Harris wrote:
> On Thu, 2005-10-06 at 08:45, Bill Perkins wrote:
> > > I believe you can use rpm to validate the files on your system.  rpm is
> > > prelink aware.  Check the verify option of rpm.  If that shows things
> > > don't match up then you have a system that may have been compromised.
> >
> > I'll take a look into that. What is 'prelink'?
> >
> >
> > Most are executables, some libraries as well (in /usr/lib, openoffice, a
> > bunch of others).
>
> Prelink is used to modify ELF shared libraries and ELF dynamiclly linked
> binaries to reduce startup time.  Check out the man page for prelink to
> get more details.
>
> The changes you describe are consistent with prelink.
You could try something like;
-->  rpm -vV -a > /root/rpm_verify 
Then try less the file /root/rpm_verify.