Is it possible to change a file retroactively in linux?

Question

linux

Hello, today we noticed a small virus on the site, it did a redirect under certain conditions, the first thing I looked at was the returned page code, but it was empty, so I went to look for a problem in the included files, and was surprised, the last file changed more than a month ago, and the virus appeared just a couple of days. As a result, the code was found, and the date of the last modification of the file was 07/31/2014, how can this be? And where to dig to prevent this in the future?

Answer 1

Easily

$ touch f122
$ ll f122 
3147683 -rw-rw-r-- 1 kruglov kruglov 0 Jul 14 10:49 f122
$ touch -t 06090911 f122 
$ ll f122 
3147683 -rw-rw-r-- 1 kruglov kruglov 0 Jun  9 09:11 f122

To follow, you need to write your own script that will check the hash of files. We uploaded the project, took a picture, then constantly check it. If something is automatically updated to the original and report to the soap about the disgrace. Well, or something like IDS - intrusion detection systems.

Answer 2

$ man touch

...
       -d, --date=STRING
              parse STRING and use it instead of current time
...

In short: touch -d 20140731 /path/to/file does what you described

Answer 3

Maybe Tripwire is right for you?
* Scans files, calculates hash, stores in database, watches for changes =)