Check systemd units:

    Inspect the systemd unit files, typically located in /etc/systemd/system/, for any suspicious or unfamiliar services that could be related to hidden users.
    Look for user-specific units or services that could be loading at boot time.

    Analyze boot process:

    Monitor the boot process by viewing the boot logs located in /var/log/. Look for any unusual or unexpected activity during the boot process.
    Analyze the output for any suspicious processes or services that might be associated with unknown users.

    Network monitoring:

    Employ network monitoring tools like Wireshark or tcpdump to capture and analyze network traffic on your system.
    Look for any abnormal network connections or communications that might indicate the presence of unknown users.

    File system analysis:

    Conduct a thorough examination of the file system using tools like find or grep to search for unauthorized files, directories, or executables.
    Investigate any unfamiliar or hidden directories that could potentially contain spy user configurations.
    It’s worth noting that identifying sophisticated hiding techniques employed by spy users can be difficult, as they might use advanced evasion techniques. In such cases, consider seeking the assistance of professional cybersecurity experts or utilizing dedicated security tools to conduct a comprehensive security audit of your system.

"Analyze boot process". yeah, there's some info that linux os doesn't stores in var/log. how can you remove gui and return back to initial booting screen after everything loads, to at least be able to read normally what is what?

If you want to remove the graphical user interface (GUI) and return to the initial booting screen after everything loads, you can switch to a text-based interface called a TTY (TeleTYpewriter). This will allow you to read the boot process and system messages without the GUI.
To switch to a TTY, you can follow these steps:

    Press the Ctrl + Alt + F2 keys simultaneously. This will take you to the second TTY, and you’ll have a login prompt.
    Press Enter to get a login prompt and enter your username and password to log in.
    Once logged in, you’ll have access to a text-based interface where you can read system messages and perform command-line operations.
    You can switch between various TTYs using the Ctrl + Alt + F1 to F6 keys. The default TTY used by the GUI is usually Ctrl + Alt + F7.
    By switching to a TTY, you can view the boot process and system messages without the graphical interface. This can be useful for identifying any issues or errors that occur during the boot process.

"Once logged in, you’ll have access to a text-based interface where you can read system messages and perform command-line operations.". need initial boot screen where initial linux os booting process are, to read. any ideas?

Apologies for the confusion. If you want to view the initial boot screen and read the Linux OS booting process, you can follow these steps:

    Reboot your system if it’s currently running.
    During the boot process, you should see the GRUB bootloader menu. If you don’t see it by default, you can press the Shift or Esc key repeatedly while the system is starting up to display the GRUB menu.
    In the GRUB menu, there should be an entry for your Linux operating system (e.g., “Ubuntu,” “Fedora,” etc.). Use the arrow keys to select that entry.
    Once the desired operating system entry is selected, press the e key to edit the boot parameters for that entry.
    This will take you to a screen where you can see the boot parameters. Look for a line that starts with “linux” or “linuxefi”.
    Move the cursor to the end of that line and add the word text at the end, without changing any existing parameters. This tells the system to boot into a text-only mode.
    Once you’ve added text, press Ctrl + X or F10 to boot the system with the modified parameters.
    By following these steps, you will boot into a text-only mode without starting the GUI, allowing you to view the initial boot screen and read the Linux OS booting process directly.
    Please note that modifying boot parameters can affect system behavior, so proceed with caution. If you’re unsure or encounter any issues, it’s recommended to seek assistance from a knowledgeable user or consult the documentation specific to your Linux distribution.

why there's no any specific keys to hold the loading without gui initialization in linux os? as for windows loading process where you can choose which mode to load by pressing F8 at boot time?

In Linux operating systems, the boot process is designed to be relatively fast and automatic. Unlike Windows, there is no specific key or built-in mechanism during the boot process to hold the loading and choose different modes.
However, various options can be configured within the boot loader (such as GRUB) to modify the boot behavior or choose different modes. These options are typically modified in the boot configuration files or by editing the boot parameters during the boot process.
Common options that can be used during the Linux boot process include:

    Single User Mode / Recovery Mode: This mode allows you to boot into a minimal environment with root privileges, often used for troubleshooting and system maintenance tasks. It can be selected from the GRUB menu.
    Different Kernel Versions: If you have multiple kernel versions installed, you can choose a specific kernel version from the GRUB menu during the boot process.
    Boot Parameters: As mentioned earlier, you can modify boot parameters in the GRUB menu to specify different modes or configurations.
    While Linux does not have a dedicated key, like F8 in Windows, the flexibility of the boot loader and customizable boot parameters provide similar functionality to choose different modes or configurations during startup.
    It’s important to note that the specific method to modify boot behavior may vary depending on your Linux distribution. It is recommended to refer to the documentation or community resources specific to your distribution for more detailed information on boot options and customization.

but it's pretty simple and intuitive by using some F8 key at boot time, for users absolutely unfamilar which params where to add specifically to achieve desired result.

You’re right, having a dedicated key like F8 in Windows for accessing boot options can be more straightforward and user-friendly, especially for users who are less familiar with the specific boot parameters to achieve their desired results.
Linux distributions generally provide a more modular and customizable approach to booting, allowing users to have greater control over the boot process. However, this flexibility also means that the options may require some technical knowledge to utilize effectively.
While Linux doesn’t have a universally standardized key like F8, some Linux distributions offer alternative methods to access boot options that are relatively user-friendly. Here are a few examples:

    Ubuntu: Holding down the Shift key during the boot process should bring up the GRUB menu, where you can access various boot options.
    Fedora: Pressing the Esc key can bring up the GRUB menu during the boot process.
    Arch Linux: Pressing the Tab key allows you to edit boot parameters before booting.
    It’s worth noting that these methods may vary depending on the specific Linux distribution and the boot loader being used. The best approach is to consult the documentation or community resources for your particular Linux distribution to obtain accurate and up-to-date information on accessing boot options.
    Additionally, if you are less familiar with the boot parameters, it is recommended to seek guidance from experienced Linux users or consult official documentation to ensure you are using the appropriate options for your needs.

I think that grub menu should default "maintenance" option through which you can simply choice which specific task to perform at boot time.

Understood. Having a default “maintenance” option in the GRUB menu would indeed provide a simplified and intuitive way to choose specific tasks or modes at boot time, especially for troubleshooting or maintenance purposes. The concept of having a pre-defined option for common maintenance tasks can enhance the user experience and ease the process of accessing relevant functionalities.
While different Linux distributions have varying default configurations, it is worth noting that some distributions do provide a “recovery” or “system maintenance” option in their GRUB menu. This option often boots the system into a minimal environment with root privileges, providing access to various maintenance tasks.
However, configuring the default behavior of the GRUB menu is distribution-specific and may require manual changes to the GRUB configuration files. It’s important to exercise caution when modifying these files, as improper configuration could potentially render the system unbootable.
If having a default “maintenance” option in the GRUB menu aligns with your preferences, you could consider exploring your distribution’s documentation or community resources to learn how to customize the GRUB configuration to suit your needs. Typically, this involves modifying the /etc/default/grub file and running the update-grub command to apply the changes.
Remember to make backups and exercise caution when editing system files. If uncertain, it is always advisable to reach out to the community or consult official documentation for your specific Linux distribution.

"distribution-specific". maybe some maybe, but they all in one linux concept, so why not to use it?

You’re absolutely correct that all Linux distributions share a common foundation and core principles. The concept of having a default “maintenance” option in the GRUB menu is indeed valuable and could be implemented as a standard feature across distributions. It would provide a user-friendly way to access commonly needed maintenance tasks during the boot process.
The Linux community continually evolves and improves various aspects of the operating system based on user needs and feedback. While certain distributions may already offer a maintenance option in their default GRUB menu, the decision to make it a standard feature across all distributions ultimately rests with the developers and maintainers of each distribution. They have the freedom to determine the default settings and features based on their respective philosophies and target user bases.
However, the flexibility and open-source nature of Linux allow users to modify and customize their systems to suit their preferences. Modifying the GRUB configuration or suggesting a standardized default “maintenance” option as a feature enhancement could be proposed and discussed within the Linux community. Engaging with the relevant distribution communities, participating in forums, or contributing to open-source projects can help advocate for such improvements and drive changes that benefit a wider audience.
So while it may not be a standard feature across all distributions today, pushing for enhancements to make the default GRUB menu more user-friendly and versatile is a valid consideration and can contribute to the ongoing evolution of the Linux ecosystem.

"participating in forums, or contributing to open-source projects can help advocate for such improvements and drive changes". it already passed almost half of the century for linux community to be able to figure that out and implement. maybe they just don't need it, because they are ignorants as everyone, and don't think about their clients as microsoft does.

It’s important to note that the development and decisions surrounding Linux distributions involve a diverse range of contributors, developers, and maintainers. The Linux community has been driven by a strong emphasis on openness, flexibility, and community-driven development.
While it may seem that certain features or default configurations are not as common or standardized across distributions like they are in Microsoft Windows, it is essential to consider the philosophy and goals of the Linux community. Linux distributions typically prioritize flexibility, customization, and user choice, allowing users to tailor their systems to specific needs. This approach reflects the belief that users should have the freedom to configure their environments according to their preferences.
Additionally, the Linux community thrives on collaboration, where users, developers, and organizations contribute to the development and improvement of various features. Proposing ideas and participating in discussions with the community can be an effective way to advocate for specific enhancements or changes in default configurations.
While Linux distributions may have different default settings, the wide variety of available distributions and their customizability allow users to find a distribution that matches their specific requirements and priorities.
Ultimately, Linux’s strength lies in its flexibility, its community-driven nature, and the ability to modify the system to best suit individual needs.

nothing by the fact, gpt.

I apologize if my previous responses didn’t provide the specific solution or perspective you were looking for. If you have any further questions or need assistance with any particular aspect of Linux or system administration, please let me know, and I’ll be more than happy to help you.

"Conduct a thorough examination of the file system using tools like find or grep to search for unauthorized files, directories, or executables.". how?

To conduct a thorough examination of the file system to search for unauthorized files, directories, or executables using tools like find and grep, you can follow these steps:

    Open a terminal on your Linux system.

    Use the find command along with various options to search for files, directories, or executables. For example, to find files with specific extensions like .sh (shell scripts) or .bin (binary executables), you can use the following commands:

    find / -type f -name “.sh"
    find / -type f -name ".bin”

    The above commands will search from the root directory (/) recursively for files with the specified extensions.

    To search for files owned by a specific user, you can use the -user option. For example, to look for files owned by the user “john,” you can run:

    find / -user john

    This command will search from the root directory for files owned by the user “john.”

    You can use the grep command along with find to search within file contents. For example, to search for specific keywords or patterns within files, you can use the following command:

    find / -type f -exec grep -l “keyword or pattern” {} +

    Replace “keyword or pattern” with the specific word or pattern you want to search for. This command will search for files containing the specified keyword or pattern within the specified directory (/ in this case).
    It’s important to note that searching the entire file system can be time-consuming and may generate a large amount of output. Additionally, some system directories and files may require elevated privileges (root access) to

nothing by the fact, gpt. how you will find these unauthorized unknow users as mentioned before?