Questions[firestarter](ubuntu)

Firestarter was a package available through Debian that showed active connections (and a few other features which gufw does not have).

You could observe the log of attempts to connect and create rules to either block or allow similar connections by clicking on the log entries.

1. Is there a way to get this sort of functionality now that Firestarter is not in active development and no longer an available Debian package?

2. And are there ways to use firestarter with a VPN?

Firestarter does not appear to have an option to enable it to run at Ubuntu startup. Is their a specific setting in Ubuntu that I need to edit to enable this?

Two process named gksu and two process named su-to-root appeared on my system monitor, is my computer owned? How can I be sure, and if this true, how can I rip out the intruder without full system reinstall?

Where and which logs I should check, and looking exactly for what?

I use Firestarter, but events logger appear empty(?)... what is another bad sign...

Thanks so much for any help.

Ubuntu 11.10

EDIT:

I forgot to mention a SH process running too

My 50-default.conf

....

# First some standard log files.  Log by facility.
#
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*             /var/log/cron.log
#daemon.*           -/var/log/daemon.log
kern.*              -/var/log/kern.log
#lpr.*              -/var/log/lpr.log
m    ail.*              -/var/log/mail.log
#user.*             -/var/log/user.log
...

AND THE PROCESS SH KEEPS REBORNING!!