On Wed, 2008-02-27 at 06:37 +1000, Michael Mansour wrote: > > # rpm -Vf /usr/bin/chattr
> S.5....T /usr/bin/chattr > S.5....T /usr/bin/lsattr > Okay, so this is saying that the size, MD5 checksum (i.e. the file contents), and the modification date/time have changed for the files. > # rpm -qf /usr/bin/chattr > e2fsprogs-1.35-12.11.el4_6.1.i386 > e2fsprogs-1.35-12.11.el4.1.x86_64 > I would say this the problem. It looks like one architecture has been updated, but the other hasn't. As such the files look wrong to one package but okay to the other. If you run 'rpm -V e2fsprogs-1.35-12.11.el4_6.1.i386' and then 'rpm -V e2fsprogs-1.35-12.11.el4.1.x86_64', you will probably find one gives no output (indicating the package is okay) and the other will give you output the same as you see for chattr/lsattr. I would suggest running something like 'up2date' or 'yum' to ensure that all your packages are uptodate. If you delete the i386 package as Nils indicated, then I would still run 'rpm -V' on the x86_64 package to ensure it verifies. John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839 ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Rkhunter-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/rkhunter-users
