[nycbug-talk] Searching for suspect PHP files...

[Matt Juszczak]

> Well if it really is keeping you up at night you can do the following:
> 1: reinstall the box from cds, feel free to make your own if you want

I'm still a bit confused.  Most root kits overwrite your system binaries 
correct?  So what would the negatives be to installing a 6.3-RELEASE 
system somewhere, somehow either checksumming or building an mtree of the 
files in /sbin, /usr/sbin, /bin, /sbin, etc. and comparing to the existing 
system (ignoring modification time of course).  Shouldn't my FreeBSD 
6.3-RELEASE system be identical in system binaries to any other 
6.3-RELEASE system other than mtime?

-Matt