Suspicious Activity with program sleep() states

Hello,

     First off I am not entirely sure that this was a compromise but I figured perhaps I could get some advice from this list.  Now onto the problem.  I recently installed openssl 0.9.7d, apache 1.3.27, and mod_ssl 2.8.14-1.3.27.  I noticed a few "weird"  things happening while running a `make certificate` for mod_ssl+apache.  The 'weird" stuff was that while I was thinking of a good name for my self-signed cert/CA if I waited too long(2-3 seconds) without typing anything it would continue as if I had pressed the return key.  It acted almost as if it had a timed delay then if nothing was entered then do the default type thing.  Now I didn't even think about this box being compromised as it is on a non-public IP LAN.  It just didn't occur to me at this point.  Now later after the cert was made and installed and apache was configured to allow users based on basic auth, I began creating the user accounts.  I entered the command `htpasswd -c users.file user` and it prompted me for a password as usual.  I use the online version of APG (Automatic Password Generator) the well generate my initial passwords.  Now it was at the prompt for the password and after I had gone to the APG site copied the password then went back to my SSH(V2) session.  I noticed that it was back at the root prompt as if I had already entered a password.  I thought this was weird so I typed in password and went back to the browser to make sure I had the correct password copied again then switched back to my ssh session and again it was back at the prompt.  Now I was suspicious and just typed in the command once more.  I waited for a bit before entering anything and I noticed that something was entering something in my SSH(V2) session, or at least that's what I was thinking then.  Now after further investigation I realized that while using truss it was getting to a sleep state and then just quitting a couple of seconds later.  I ran truss on `od -` as well and after a couple seconds same thing so it wasn't focused on the passwd command or anything similar to that.  I did however think it might be a library issue perhaps?  Anyways I tried to duplicate it on another machine and couldn't as was expected.  I then tried to show a few other people and couldn't duplicate it on the same machine with the same login(root).  I luckily(arguably) had kept open the session that was showing the suspicious activity.  I then realized it was only on one session I had.  I looked through my logs and saw nothing unusual except some ECC errors of which I thought maybe might be causing it but couldn't justify why only one session was being affected even after new ones had been created.  I ran the coroners toolkit against the whole system and had a look through those and also had a look at my MD5's of the files from my jumpstart build, and still nothing came up.  Someone here ran the crypt alg.(perl -e 'printf("%s\n", crypt("", T8));') for a blank password and it matched what was in the htpasswd file(T8fNhK/8Wk6Ds).  This all started happening around 9:30am (AEST) and continued until about 6:30pm(AEST).  Contrary to better judgment I have since rebooted and have continued working with this machine(no choice really).  Does anyone have any thoughts? Could this just be memory related?  I am happy to provide more detail if necessary.


Chris-