"ls" staying as "sleeping process"????

[shadedecho]

RH7.1:

i've noticed lately that intermittently (though it seems nearly all the time), I will see that I do a "ps -aux" command and all looks fine, and then I do a "ls" command, and then another "ps -aux" and I see that the ls command is still in the process list with "S" as status (S = sleeping, i guess). Why is this? What is going on?

 

[shadedecho]

I just noticed something... it *appears* what is happening is that the last executed process is what is staying in memory... but even that is strange, because....

if I do a clean "ps -aux" and nothing but the normal stuff shows up, then i do ANY command, like su or chmod or ls or whatever, then i do "ps -aux" again, whatever that command was shows up in the process list. Thereafter, executing any command, like ls or chmod or whatever, does NOT change the process list. But, as soon as I kill that "sleeping" process of that first command, then execute any other command, it takes its place...

This makes me wonder why the first execution of any of these commands is getting stuck in memory, but then not replaced by subsequent runs of that command? AND, I also notice this is only occuring when running these commands as root, running them as any other user does NOT get them stuck in memory.

i am now starting to think that my system may have some trojan or that the filesystem commands have been hacked so that they are loading some trojan into memory on their first execution. anyone have any ideas?