[vox-tech] vnc highjacked?

[Hai Yi]

Hello All:

I installed a x11vnc on my home server, and scarily found that someone
is remotely controlling my desktop: when I use vncviewer to see my
server's desktop, i noticed the mouse moving on the browser and typed
in some paypal sites to open them.

I don't know how the server was highjacked like this? How can I check
the log to find out more?

I checked auth.log, only found some failed attempts through ssh port.

pls help me out, thanks!

Hai