Nevermind
 

Nevermind

It is considered good site etiquette to leave the problem up and then, when you work it out, to post up the solution so others will know what to do.

Got you.

Friend told me to type in who

Showed up:
root - tty1 - Sept 28 07:04
cs - pts/0 Oct 12 :1727 (my hostname)

So we assumed it was the hosting company.

But that hasn't actually told you who did it. really, all that says is that someone logged into your pc as root at 1727.

I'd have a search and look at what was changed at that time and find out who would need to log in as root. If they are doing this without your knowledge or consent, your files and data are insecure.

I would immediately change your root password and look into using sudo. Then again, since you don't know what they did, it may be better to just rebuild.

Hello,

I e-mailed my server provider and they said that for some reason it was still logged on from when they rebooted it.

That is very strange indeed. Do you use a graphical login? It may be set to autologin root by default. And that is bad for security and your system.

No SSH only

I agree with XavierP, very strange. And connected for 14 days...

In that case, the best (to be really sure) is a reinstall ...

bye