ethtool trojan detected by NAI

[Leonard den Ottolander]

Hi Charles,

> > -rwxr-xr-x    1 root     root        83684 Sep  5 21:14 /sbin/ethtool

> -rwxr-xr-x    1 root     root        83684 Sep  5 14:14 /sbin/ethtool
> 
> 
> Notice that while my length and date agree with yours, my time and
> md5sum do not.

I explained the md5sum mismatch in my other post (indeed prelink). The
difference in date is because your RTC probably uses local time, and his
GMT.

> Question: is prelinking the culprit on the length and md5sum
> differences?

I haven't read anything on length mismatches.

Bye,
Leonard.