There are root kits for Linux. Maybe you just have a root kit.

You should consider using a VM to access the internet to isolate any danger
to the VM. You clone the VM and then if it is corrupted you just delete the
old VM and start a new one from the clone.