Re: [CentOS] How to tell if I've been hacked?

...

Also processes you thinkk you DO recognize: Just for testing how alert my co-workers were, i had a program called "kswapd", just calculating prime-numbers... They never noticed. ;-)

Without any preperation it's harder. No point in installing tripwire, activating apparmor/selinux afterwards. Those things should be done after a fresh installation.

Indeed. I once found a gdm binary that had been subverted. I'm certain that would fly below the radar of many organizations.

hence 'rpm -Va'. No such facility with dpkg so maybe not a common thing to do but this should be pretty much standard Redhat/Centos procedure for checking for corrupt/modified binaries/libraries.