Blog relay:Detecting a Compromise:

Is there any normal operation that can change the programs in GNU/Linux system?If not , then my computer has been intruded. Damn it! You can validate your programs in the system , too . Just rpm -Va .

http://ist.uwaterloo.ca/security/howto/2000-10-02/compromise.html

Interesting part:

The command 'rpm -V -a' will verify the integrity of your system. We're particular interested in files that should not have changed:

rpm -V -a | grep -v ' c ' | grep '^..5'