[nycbug-talk] Searching for suspect PHP files...

[Matt Juszczak]

> Not really.  mtree(8) by default takes into account mtime, so if you
> rebuilt the system at any given time, you need to start from scratch
> with the new fresh specification file.

OK.  Surely there's a way to check out a system where this procedur wasn't 
performed.  I guess, potentially, using chkrootkit comparing sources 
compiled in /usr/src?

-M