How do I find out how these file were changed?

[tommyk]

Hi,

Got this today and I was thinking it was worth investigating;

Code: Select all

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/bin/crontab: FAILED
/bin/passwd: FAILED

How would I go about to check how these files was changed?

Regards,
Tommy

[cre8gr]

Got almost the same thing today:

Code: Select all

Oct 23 06:00:29 optimus lfd[19844]: *System Integrity* has detected modified file(s): /bin/crontab /bin/passwd

The only thing I think of is maybe cPanel's update that was made at 05:32 today, but half an hour isn't it long for the update to complete?

Please advise, thanks!