I normally take a look at ps -ef when I login to my "main" machine. It functions as a server of DNS, HTTP, IMAP and SENDMAIL connected to the Internet. When I did so tonight, I noticed a funny user id doing things... They were trying to run /bin/ping to WWW.YAHOO.COM and /bin/ftp to somewhere... I removed both of these ASAP.