This question already has an answer here:
Yesterday I noticed that the xterm title I use changed suddenly to something strange. So I suspect that someone hacked my Linux laptop (I'm using Arch). I changed the WiFi parameters (pass, essid) and changed my password on the computer. I also reinstalled all packages to overwrite files that may have been changed. I tried to take a look at the changed files, logs and so on, but I don't have experience in security, so it was like walking in the dark ;) and of course I didn't found any signs of intrusion. Do you think I should wipe the system and install from scratch?