Two process named gksu and two process named su-to-root appeared on my system monitor, is my computer owned? How can I be sure, and if this true, how can I rip out the intruder without full system reinstall?
Where and which logs I should check, and looking exactly for what?
I use Firestarter, but events logger appear empty(?)... what is another bad sign...
Thanks so much for any help.
I forgot to mention a SH process running too
.... # First some standard log files. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log #daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log #lpr.* -/var/log/lpr.log m ail.* -/var/log/mail.log #user.* -/var/log/user.log ...
AND THE PROCESS SH KEEPS REBORNING!!