how to tell when you have a hacker?

[Mike]

On Saturday 18 February 2006 08:20 pm, Darrin Chandler wrote:
> You might try looking for /etc/rcX.d/SYYsshd, where "X" is the runlevel
> you start up in, and "YY" is any two digit number. If you find that
> (symlink), rename SYYsshd to KYYsshd (from start to kill). There's
> probably an admin widget to do this for you, but I don't know where to
> find it for you.

 I did a 'man sshd' and see that it is indeed started by an rc?.d . However, 
How does one edit an rc.d file? I tried jpico but it said, 'error reading 
file' and vi says, 'not a regular file'.