It's a novel password capture program which went wrong because the person who made it was to stupid to realise that you have to pass the values to the original box.. either that or they just wanted to piss people off.. What you could do is boot into console mode and check the logs and see who has been accessing files etc.. But yeah it all depends on the methods used.. thats why u need logging
you can look for suspicous behaviour. Your system admins job is to do that.. and if your the system admin then you should have known about it before it was implemented
