Hi Sven,
the files belong to rpms, so you can verify with rpm if the files are really changed, if yes, check the files against the originals with diff. That makes it more possible to determine whats changed.
Sorry, I forgot to send this info: I'd run diff against the original: They don't differ!
maybe, just a fscked harddisk ...
What does this mean?
I am running iptables on this machine and only port 53 is open for IN and OUT.
what version of bind are your running there? Are you sure that all other ports are closed? (ssh?)
That's a little misunderstanding: I'm not running bind on this machine; the ports >1023 are open for dns-lookups to one special IP - this machine do not listen on port 53 but the iptables-script allows connections to my nameserver and back.
HTH Sven