If you believe that your system has been compromised, deciding what to do next can be difficult. How quickly you can respond to a possible security event, and what to do in the meantime, varies depending on the level of risk you're willing to accept. This may impact your choice of what to do next. The steps involved in recovering from an incident can be quite severe. Once you are able to recognize normal system activity, you will be better equipped to determine when something isn't right.
Awareness is the key here.
Intruders are counting on their presence going undetected. Security is one place where an ounce of prevention really is worth a pound of cure.