Micky L Martin wrote: > Because rpm and rpmverify also seemed to have been modified so I cannot > trust 'rpm -V' package verification. > > Already did lsof and process tracing but to no avail. Does anyone have any > idea how to find that culprit? Are you sure it's not prelink that's modifying the files? You can google how to disable this. Boot from a CD to check the checksums or run rpm if you want a clean environment. Jeremy