Cannot execute basic linux commands (ps, ls, ifconfig) - File not found

Question

I am running Ubuntu Linux, and am having some major system issues (networking not working, etc), which I think could be based on this fundamental problem.

When I try execute a variety of basic commands (including ps, ls, ifconfig, locate), I receive the error 'no such file or directory'.

Here are some suggestions that I've found online, that I have tried without success:

1. I did a 'whereis ps' and found the file in the /bin/, and have checked that '/bin' appears when I do 'echo $PATH'
2. I did a filesystem check which showed my hard drive as being clean
3. I tried doing a 'sudo chmod 777 ps' but was told that I dont have permission. I don't think permissions for these files would have changed though (and I can't check as I can't run the 'ls' command).

Any help would be highly appreciated.

Solution

To cut a long story short, it looks like I was rooted by SHV4 / SHV5 rootkit. I will soon be formatted and reinstalling my box.

For future reference though, I was able to fix the file permissions by changing the file attributes (chattr -ais <filename>) and then changed the file owner back to root. The files were infected anyway though.

Thanks to all for you help and suggestions

Comments

[Erik]

/usr/bin/ldd /bin/ls

[pconcepcion]

To try any command (I use ls in my example) you can try to do a whereis ls and try to execute it using the full path, like /bin/ls.

[Admin]

Maybe you are using some restricted shell? what is the output of echo $SHELL?

[mmmmmm]

What exactly is the output of echo $PATH

[LawrenceC]

cd into the directory and then prefix the command with an ./; i.e. cd /bin; ./ps.

[Mr. Shickadance]

How did you discover that? Could you please add some details?

[Antony]

After I changed the attributes and ownership of the infected files, I still couldn't execute them and that's when I realized that something else was going on. I noticed that the owner of the infected files (before I changed it) was '122' so I started Googling, found articles on the SHV4 / SHV5 rootkit, and noticed that all the files it infects (ps, ls, netstat, ifconfig, find, top, etc) were the ones with that owner.

[Mr. Shickadance]

Well, at least you identified it. Thanks for the follow-up.