how to tell whe you have a hacker?

[Technomage]

On Friday 17 February 2006 17:58, Mike wrote:
> uh-ohhh
>
> 	Checking `sshd' ... /usr/bin/strings: Warning: `/' is not an ordinary file
> 	not infected
>
> 	Checking 'lkm' ... You have      4 process hidden for ps command
> 	Warning: Possible LKM Trojan installed
>
> Is this bad?
it *can* be.

if you are using an rpm based distribution, you can do a special query of all 
the installed packages to see which ones have been changed.