Could you please enlighten me why I get messages like
'nvi successfully recovered smb.conf'
or the like, when I restart a crashed unix server?
(Nvi also tends to recover .pl scripts).
This seems strange for me, since I can bet these files were not opened by anyone for writing (at least I strongly hope so).
So, why they need recovery after a system crash?

nvi is a version of the vi editor - it will recover semi-edited files from unsaved sessions where the editor wasn't exited properly. i guess that means when anyone is messing around with files they can't edit, they exit vi improperly (or are cut off during a system crash), and nvi saves it in a buffer somewhere.

...that, or some cron script is using vi to update files, which i find somewhat unlikely... hmm.

there is a chance someone's using it to hack the system tho :
http://linux.oreillynet.com/pub/a/li...ities.html#nvi

also somewhat unlikely, but definitely worth checking into.

There are some cron jobs, but none of them is intended to edit any files.
What to check in order to find out if I am hacked?

Not being a guru I checked 'last' (only showing my logins) and /var/messages, so far, but I am almost sure that a hacker can delete evidences from such obvious places.

i really wouldn't know what to check for. i don't think it's very likely that your system has been compromised in any way, but i'd recommend upgrading the program just to be safe. you can get the latest version here - http://www.bostic.com/vi/

nvi uses a different buffer and recovery system than vim or classic vi uses, so i'm not sure how it would act after a system crash. i think it's much more likely that the recoveries you're seeing are a result of interrupted sessions rather than anything sinister. you might want to check in your startup scripts to see if there's anything nvi uses to recover crashed sessions at startup. i found this about nvi recovery - hope it helps :
http://www.neosoft.com/neosoft/man/vi.1.html#sect4