find / -xdev -ctime -1 As root, redirect that command to a file before installing a package. Correction: "immediately after" installing a package, not before. But, what's to say that a trojan couldn't alter a file time or time stamp (which, in turn, would render that find command useless)