As far as I know, there is no way to restrict a user from changing the modification time of a file. Changing the modification time is a normal feature, use for example when extracting files from an archive or copying them from another machine.
Instead of looking at the modification time, look at the inode change time (ctime). Pass the option
ls to list the ctime instead of the mtime.
Listing the ctime lets you detect which files have been modified or moved recently. It may turn up false positives, of course. If the attacker has root access, all bets are lost.
This is more useful for forensics than for repair. Only the most basic attacks can be countered by a simple repair like removing the obviously-infected file: usually there's more stuff than what you can find. If you detect an attack:
- Take the system offline. Make a copy of it.
- Reinstall the whole system from known good sources. Don't reuse anything from the infected system: you can't trust it. Be sure to install the latest versions of all software, with no known security holes.
- Restore your data from a known good backup. Again, you can't trust data produced by the infected system.
- Study the copy of the infected system to figure out how the attackers got in. Note that how the attackers got in (the vulnerability) is very different from what the attackers later did (the payload). You need to track down the root cause, not the symptom. This part may require a professional.
- Once you've established that the root cause is no longer present (the misconfiguration or security bug has been fixed), take the new system online.