is this result of keylogger? am i hacked?
I found yesterday that some files in /etc/ (/etc/shells and
/etc/default/default/schroot) are changed. They contain data which I was
typing on keyboard. Strange enough, this files are not overwritten, but
contain data they should contain + somewhere in the middle or at the
beginning of the file they contain something I typed in browser or in
command line in X window system.
This looks like that I am hacked and somebody try to get my passwords.
But may be there is another explanation, like broken package? Or can
somebody suggest, how can I check it? Reinstalling everything from
scratch is a lot of work...
System is squeeze, upgraded from lenny few weeks ago.