is this result of keylogger? am i hacked?

[Sergey Spiridonov <sena@hurd.homeunix.org>]

Hi

I found yesterday that some files in /etc/ (/etc/shells and 
/etc/default/default/schroot) are changed. They contain data which I was 
typing on keyboard. Strange enough, this files are not overwritten, but 
contain data they should contain + somewhere in the middle or at the 
beginning of the file they contain something I typed in browser or in 
command line in X window system.

This looks like that I am hacked and somebody try to get my passwords. 
But may be there is another explanation, like broken package? Or can 
somebody suggest, how can I check it? Reinstalling everything from 
scratch is a lot of work...

System is squeeze, upgraded from lenny few weeks ago.