Output the /var/
spool/cron/crontabs/root file here, please, as this is the only one to have been changed recently. (It's possible to modify a file and then to reset it's modification date, but let's try first for the obvious.)
Also, here are the processes I am most worried about. There may be nothing to them, but it might be a good idea to investigate them further. If it will do no harm, kill them (the -ksh should be killed with -1 signal):
Code:
root 1085514 389334 0 11:30:23 pts/10 0:00 -ksh
ssfactor 372750 950456 0 10:54:00 pts/7 0:00 wsmenu.4ge wsmenu
ssfactor 1024094 1 112 06:39:53 - 290:08 wseinvce.4ge wsrprtiv MENU:
root 315558 254088 0 May 06 - 2:34 /usr/bin/perl /usr/factor/r
These are probably harmless, but I don't know enough about AIX to be sure
Code:
root 237684 106644 0 May 06 - 0:05 /usr/sbin/aixmibd
root 151688 106644 0 May 06 - 0:00 /usr/sbin/biod 6
root 233586 106644 0 May 06 - 0:00 /usr/sbin/hostmibd
root 163968 106644 0 May 06 - 0:00 /usr/sbin/muxatmd
root 290968 106644 0 May 06 - 0:00 /usr/sbin/writesrv
root 262276 1 0 May 06 - 14:39 /usr/bin/xmwlm -L
root 168056 1 0 May 06 - 0:00 /usr/ccs/bin/shlap64
root 118874 1 0 May 06 - 0:00 /usr/lib/errdemon
root 106644 1 0 May 06 - 0:00 /usr/sbin/srcmstr
root 286878 1 0 May 06 - 0:00 /usr/sbin/uprintfd