[CentOS] Files being modified in /bin/

Micky L Martin wrote:

> Because rpm and rpmverify also seemed to have been modified so I cannot
> trust 'rpm -V' package verification.
> 
> Already did lsof and process tracing but to no avail. Does anyone have any
> idea how to find that culprit?

Are you sure it's not prelink that's modifying the files? You can google how 
to disable this.

Boot from a CD to check the checksums or run rpm if you want a clean 
environment.

Jeremy