🚀 go-pugleaf

This is *really* very weird.

It worked six days ago, when I last su-ed, but now
my /bin/su.nowheel has been corrupted and doesn't work
anymore.

From my machine (3.0):
> nextasy>ls -l /bin/su*
> lrwxrwxrwx  1 root          10 Jan  9  1991 /bin/su -> su.nowheel@
> -r--r--r--  1 root        2448 Jul 22 11:29 /bin/su.nowheel
> -rwxr-xr-x  1 root        7096 Jul 21 12:48 /bin/su.wheel*
> 

From a healthy one (3.0):
> micro> ls -l /bin/su*
> lrwxrwxrwx  1 root          10 Feb  6  1992 /bin/su -> su.nowheel@
> -rwsr-xr-x  1 root        7048 Jul 21 18:48 /bin/su.nowheel*
> -rwxr-xr-x  1 root        7096 Jul 21 18:48 /bin/su.wheel*
> 

Notice how it's not just the permissions that have changed, the
actual file *size* is different. As it is now, even if I give
execute permission (and even set the setuid bit on - as I unwisely
did before noticing it wasn't just permissions), it doesn't run
at all (produces a few error messages and dies)... Notice the
modification dates...

How could this have happened? Do I have a malevolent hacker
on my hands? (I did give an account to someone I don't know
very well about one month ago... although I have no reasons
to suspect him of anything, and I know from /usr/adm/messages
that he hasn't tried to su root.)

Any ideas?
--
Pascal "The Rascal" Gaudette       pascal@nextasy.physics.mcmaster.ca
MacNUG president                      | *NeXTmail encouraged* 
graduate student, McMaster university | Je ne suis pas infaillible.
Physics and astronomy dep.            | Vive le Quebec LIBRE!