Odd /usr/bin/kill behavior

Question

I have a Solaris 10 container that I have installed some of the blastwave programs in. Today, I installed and then attempted to stop the milter-greylist daemon which still uses the legacy rc style of initialization.
Running the shutdown script produced the following results:
bash-3.00# /etc/init.d/cswmiltergreylist stop
Shutting down milter-greylist: ... initial gids (should be 0/0): r/egid=0/0
SETUP ERROR: re-run set-group-ID guest
Use chgrp(1) and chmod(1)
For example, do this as root (nobody is the name of a group in this example):
# chgrp nobody /usr/bin/kill
# chmod g+s nobody /usr/bin/kill
done
and running /usr/bin/kill on its own resulted in this:
bash-3.00# /usr/bin/kill
initial gids (should be 0/0): r/egid=0/0
SETUP ERROR: re-run set-group-ID guest
Use chgrp(1) and chmod(1)
For example, do this as root (nobody is the name of a group in this example):
# chgrp nobody /usr/bin/kill
# chmod g+s nobody /usr/bin/kill
The size of /usr/bin/kill on this computer's global zone is different from my other Solaris 10 servers.
This host:
bash-3.00# ls -l /usr/bin/kill
-r-xr-xr-x 1 root root 7772 Feb 26 12:23 /usr/bin/kill
Another Solaris 10 host:
bash-3.00# ls -l /usr/bin/kill
-r-xr-xr-x 17 root bin 134 Jan 21 2005 /usr/bin/kill
I tried checking the md5 sum of /usr/bin/kill in the Solaris fingerprint database, but don't believe that it covers Solaris 10.
Has anyone else seen this behavior and what did you do about it?
TIA

Answer 1

"it seems that I accidentally installed something"... so you can't recall installing any such thing?
I can't even imagine which tool or package might replace /bin/kill..
If core system utilities suddenly change behaviour or file size, you might have a rootkit on that box. Better run a thorough check.. or reinstall.
Especially if the new file version is about fifty times as big.. that smells like it contains unexpected additional "features" now. At least compare file sizes of the other core system binaries to your other host..