suspicious lpd started

[bill07@shaw.ca]

Hi,

3 days after starting my potato system lpd started to run.
system started Feb 6
ps output:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 6833  0.0  1.3  1052  412 ? S    Feb09   0:00 /usr/sbin/lpd
root 6836  0.0  1.5  1076  468 ? S    Feb09   0:00 /usr/sbin/lpd
or 
root 6833  0.0 1.3 1052  412 ?  S Feb09   0:00 /usr/sbin/lpd
root 6836  0.0  1.5 1076 468 ?  S Feb09   0:00  \_ /usr/sbin/lpd


lpd is not in startup or any cron job.  daemon.log is clean with no 
evidence of it starting.  no apparent rootkits, connections, and 
last/lastlog is clean.  How can this happen? Any ideas? I have bind 
running on port 53 (everything else is filtered)

thanks