On 6/16/05, Russell Coker <russell@coker.com.au> wrote: > But if someone can change the cache of data written by prelink then why > couldn't they also change the program that does the md5 checks to make it > always return a good result? A long, long time ago, you were supposed to boot from a read-only floppy and run the virus scanner from there. I guess the same applies here, if you really wish to be sure.