A long time ago when a LAMP box of mine got hacked.. they installed a program in /tmp/<random characters> that would connect to IRC servers. Basicly they made my box a bot. The way I found it was I saw outgoing IRC connections when I was in netstat looking for something else.
They got me thorugh and expolit in awstats which I no longer run. The only way I was sure that I got rid of the hack was I wiped and reloaded the machine from scratch. Long of it is.. check for odd processes as well. -- [email protected] mailing list
