That is a realllly long MAC address...

Is this from your system log? or a firewall log? or something like snort? I may be wrong but isn't SuSE-FW-ACCEPT the firewall?

You said that you saw a shell running that you didn't open. Who was the owner of the shell? Was it your account or root or one of the system accounts?

This one is confusing me because it looks like a TCP connection to port 4899 on your machine from port 30134 of the other machine.

okay... 4899 is the default port for Radmin http://www.famatech.com/default.html I believe that is just a windows product though. So it was probably just a port scanner touching your machine to see if radmin was installed. but..I am not going to guarantee that.