md5sum changes each time

md5sum changes each time

Post by bluesm » Thu, 11 Jul 2002 00:57:51



Hi,

I created a md5 check list for the /bin directory on my linux box.
After a while I check this directory agains the formerly created list.
The first few times the check is ok. But after a few hours the check failed.

What can this be? A virus, worm or something else?
Is my server infected by a rootkit?
I found no funny files or modules.

Thanks for your help.

Lothar

 
 
 

md5sum changes each time

Post by James Ride » Thu, 11 Jul 2002 01:17:27



> Hi,

> I created a md5 check list for the /bin directory on my linux box.
> After a while I check this directory agains the formerly created list.
> The first few times the check is ok. But after a few hours the check failed.

Why don't you run a diff at the same time to see what has changed?
The output of eg. "ls -l" will change with time - one of my entries
"Mar 25 14:10" will change to "Mar 25 2002" at the end of this year I
think.

cheers,
 Jamie
--

MSc student, Dept. of Informatics, University of Edinburgh.

 
 
 

md5sum changes each time

Post by those who know me have no need of my nam » Fri, 12 Jul 2002 20:07:43


in comp.security.unix i read:

Quote:>I created a md5 check list for the /bin directory on my linux box.
>After a while I check this directory agains the formerly created list.
>The first few times the check is ok. But after a few hours the check failed.

>What can this be? A virus, worm or something else?

unless your system has faulty memory you've been cracked, and the chance of
the former allowing your system to run usefully is just about nil, i.e., it
sounds like it's time to wipe and re-install.

--
bringing you boring signatures for 17 years

 
 
 

1. change ctime [creation time] of a file to any time?


I check both Solaris touch and GNU touch, none of them update ctime.
The following is GNU touch usage:

     touch [-acfm] [-r file] [-t MMDDhhmm[[CC]YY][.ss]] [-d time]
     [ - -time={atime,access,use,mtime,modify}] [--date=time] [--
     reference=file] [--no-create] [--help] [--version] file...

ctime is not there. I assume that you can not change ctime to any
time.

You can change system time and then use chmod, but that is not acceptable.

2. Setting keymap during boot

3. Exact time for Daylight Savings Time change

4. Dual NIC CARD HELP

5. why can't I change the "change time" of a file

6. Orchid SoundWave 32 results

7. Changing file contents without changing time.

8. weird RealAudio

9. Change File status change time

10. How to change file "last status change time"?

11. Why is Veritas Netbackup changing inode change time?

12. convert UT time in local time / local time in UT time