Weird and insecure su problem

[Pigeon <jah.pigeon@ukonline.co.uk>]

The story so far:
- Accidentally nuke shared libraries; system dies
- Unpack base2_1.tgz off original Debian 2.1 install CD; manually copy
in enough of this and the rescue disk to get it to boot again
- dpkg -i everything in dists/stable/main/binary-i386/base
- Fire up dselect and reinstall everything from CD

Now it pretty much works again but I have a weird problem with su.

I can log in either as root or as pigeon without problems.

If I log in as pigeon, and su root, and enter the root password in
response to the Password prompt, I get "incorrect password".

If, however, I enter _no_ password, I get:
: command not found
' is not an octal number from 000 to 777
: command not found
: command not found

and a somewhat mangled prompt; then
whoami
root

- so I've su'ed to root without entering a password. WHAT?

Wondering about the mangled prompt, I did echo $PS1 | hexdump and got:

68 5c 5c 3a 5c 77 20 24 0a 0d
                        ^^^^^

So I've got some MS-DOS format file with carriage returns in it. I
suspect the ": command not found" is for the same reason. I think this
has come from the install CD (2.1) as that has some files with MS-DOS
CRs in.

Trouble is, I've no idea which one (and there are a lot of files on
the install CD!), or if this is related to the no-password problem -
which is the more severe problem, I have NO intention of connecting to
the internet unless this is solved.

Any ideas?

Pigeon