Install the following tools and check what IP's they are. But as I'm getting something fishy.
Chkrootkit - chkrootkit can be used to help determine if a machine has
been compromised. While not what you should use for the 'final word'
on if you have been compromised, it runs a lot of useful checks and
can direct suspicions towards finding a solution. To install
chkrootkit install the chkrootkit package.
Rkhunter (Ubuntu 6.06 and above only) - another rootkit detection
software. Install the rkhunter package from the Universe Repository.
tiger - Tiger is a package consisting of Bourne Shell scripts, C code
and data files which is used for checking for security problems on a
UNIX system. It scans system configuration files, file systems, and
user configuration files for possible security problems and reports
them. Install tiger chkrootkit john.
denyhosts (Ubuntu 6.10 and above only) - scans your SSH logs to find
brute-force attacks, and then blocks the IPs they came from. To
install denyhosts install the denyhosts package.
you must know them what they are and then only you can sort out them.
Install the above tools with from terminal or software centre.
If you would like to go from terminal , do like
sudo apt-get install chkrootkit rkhunter tiger denyhosts
you must read the Documentation of those tools to have a better understand on their usage.
I found some helpful links for you: Rootkit Detection ,Server Security & Tiger