Changing binaries

[Giles McGarry]

Dear all, I've just inherited a debian system.  I'm affraid I'm not very experienced with Debian, coming more from a Solaris background so please be patient if the questions are numpty.

I have a problem at the moment, strangely various binaries in the /bin directory are changing size and becoming corrupt.  When I restore the original they work ok, and then at some time later they change size and stop working.  I've now restored all of the files (there's about a dozen) into /bin2 which I can use when the ones in /bin get corrupt.  The original (and working file in /bin2 is as follows:

/bin2/ls -l /bin2/ls
-rwxr-xr-x  1 root root 75948 Jul 31 17:17 /bin2/ls

but the one in /bin is different ie

/tmp/ls -al /bin/ls
-rwxr-xr-x  1 root root 80044 Jul 31 21:29 /bin/ls

As you can see it changed size recently tonight.  Looking in /bin all of the following files are also larger than they were and have all changed size at the same time:

-rwxr-xr-x  1 root root  80044 Jul 31 21:29 vdir
-rwxr-xr-x  1 root root  34456 Jul 31 21:29 touch
-rwxr-xr-x  1 root root   9716 Jul 31 21:29 tempfile
-rwxr-xr-x  1 root root  16312 Jul 31 21:29 sync
-rwxr-xr-x  1 root root  17944 Jul 31 21:29 rmdir
-rwxr-xr-x  1 root root  34808 Jul 31 21:29 rm
-rwxr-xr-x  1 root root  17944 Jul 31 21:29 readlink
-rwxr-xr-x  1 root root   9672 Jul 31 21:29 mktemp
-rwxr-xr-x  1 root root  23276 Jul 31 21:29 mknod
-rwxr-xr-x  1 root root  24984 Jul 31 21:29 mkdir
-rwxr-xr-x  1 root root  80044 Jul 31 21:29 ls
-rwxr-xr-x  1 root root  27192 Jul 31 21:29 ln
-rwxr-xr-x  1 root root  57772 Jul 31 21:29 gzip
-rwxr-xr-x  1 root root  80044 Jul 31 21:29 dir
-rwxr-xr-x  1 root root  35820 Jul 31 21:29 df
-rwxr-xr-x  1 root root  32684 Jul 31 21:29 dd
-rwxr-xr-x  1 root root  55308 Jul 31 21:29 cp
-rwxr-xr-x  1 root root  38668 Jul 31 21:29 chown
-rwxr-xr-x  1 root root  35308 Jul 31 21:29 chmod

all of them slightly larger than what they should be.  When I run the currupt verion of /bin/ls I get the following:

# /bin/ls
Segmentation fault

I've just written a script to watch the files changing so it restores them, but that's no fix at all  I've tried to ascertain  why they are changing but cannot get to the bottom of it, sometimes it's actually while I'm on the system.  Strangley I also have a copy in /tmp that I've had there all day and that's never been corrupted it has same ownership permissions etc as the one in /bin/ls.

Also I've got various commands hanging around in a ps listing, either supposedly still running or defunct, eg

root      2142     1  0 Jul27 ?        00:00:00 mv ls.corrupt ls

From the other day when this occured, and

root      2143  2142  0 Jul27 ?        00:00:00 [mv] <defunct>

And I have a few hundred lines like this.

Very strange and I'm pulling my hair out at the m oment trying to figure it out.  I've not rebooted the system as I'm remote from it and I don't want to take the chance of it not coming back while I'm not there.

As I say I have inherited the system and have no real prior knowledge of the box or what our old admin did on there, so any help greatly appreciated.

Thanks