Do I have a Linux Trojan?

[Clinotus]

I get this window Image(Question Applet), every once in a while, completely random occurances. I normally cancel the window or type in some nonsense word, and IMMEDIATELY afterwards the router > Modem light flashes. So this innocent applet is obviously sending data somewhere. I try to drop down to the task list to catch the process but the process only lists itself as "Question". Any advice?

 

[CTho9305]

Interesting... you should be able to do a tcpdump and see what its sending where.

 

[FUBAR]

try a

whereis question

or if that fails,

find / -name question

looks suspicious though. I used to have boxes pop up asking for the root password, but that was because I had kppp installed incorrectly and they were always labeled as such