So, I'm looking at my Snort logs with a focus on looking for odd after-hours type of file-transfer nastiness, and I keep seeing Yahoo IM logons from the same box at random late-night hours during the night.

I don't *think* anyone's on the box at those hours... ;-)

If someone leaves the IM open, does it periodically re-logon (refresh?) itself? Is this typical behavior for IM, IRC, or any of those? (Yes, I'm aware the 'bot C&C over IRC stuff -- just not sure what's "normal").

Thanks in advance,
~m