Casper Pedersen wrote: > I had the same problem. The issue is prelink (/etc/cron.daily/prelink), > and the only way I found to solve the issue is to move prelink out of > the cron.daily directory. > > After that remove /usr/lib/AntiVir/antivir and reinstall the > antivirus toolkit. > > Regards/Casper > > On Tue, 2004-01-06 at 00:03, John Stroud wrote: >> I need a little help trying to solve a fedora-related >> mystery... I'm hoping someone has seen this or has some >> magical insight... >> >> The executable file /usr/bin/AntiVir/antivir >> (http://www.hbedv.com/) is getting modified sometime during >> or after the default cron.daily run. After the cron job the >> file is 1160 bytes longer than it was prior. (See [1]) >> <snip> Casper, et al, Thanks again for the pointing out of the culprit. FYI, here's my interim work around until blacklisting is included in prelink: mv /usr/lib/Antivir /usr/local/lib/ ln -s /usr/local/lib/AntiVir /usr/lib/AntiVir Since the -l flag is used throughout the /etc/prelink.conf setup, it seems the directory symlinks in /usr/lib are not walked, and the antivir executable is not modified with this layout. My only test thus far was to run /etc/cron.daily/prelink manually and watch the antivir binary and its operation, which all appeared normal prior and subsequent to running prelink. -- John Stroud Senior System Admin Piedmont, CA 510-501-9173 (Cell)
