How can it be verified that the package has not been altered?

A systems administrator has recently downloaded a network analysis tool from an FTP repository. After installation of the tool, suspicious behavior is noted. How can it be verified that the package has not been altered?

A.
Boot the system from a live CD distribution and run the fsck tool on the partition where the package is installed.

B.
Download the MD5 hash file from the original FTP site and compare it against the MD5 hash generated from the downloaded file.

C.
Uninstall the application and re-install it while in single user mode and carefully watch the install logs for suspicious activity.

D.
Download the MD5 hash file from the original software developer’s website and compare it against the MD5 hash generated from the downloaded file.