I'm running a Ubuntu 6.06 dapper server and it has been hacked. I'll admit up front here that I'm a programmer and not a system administrator so even though I've worked with Unix/Linux for years my skills as a sysadmin are extremely weak.
I host a website that is running apache 2 and tomcat to serve up a Java based Struts web application. The performance of the site was getting really bad and after poking around trying to understand what the problem might be I discovered that a temp directory in my home directory was getting filled with files called getsetup.hb.*
This was new so I dug around a little more and found by running ps -ef that there were a couple of processes running that I wasn't aware of and looked a little strange to me, /boot/.IptabLes and /boot/.IptabLex
I searched the web for a clue as to what these files were and tried running netstat to see what foreign hosts were connected. Both .IptabLes and .IptabLex were connected to IP addresses that belonged to China Telecom.
This was a shock to me because I had the iptables firewall software configured so it would only allow connections to the web server on port 80 and ssh on port 22 was limited to a static IP I use at home so I can access the server remotely.
I killed the processes, removed the files from the /boot directory and also found copies in the root and in /usr which I removed. I also changed the root password.
Logging in again today I see the files are all back again and the connection to the China Telecom IP's have been re-established.
I have no idea how to proceed here. Please forgive my ignorance but I'm hoping someone can direct me as to how to proceed from here to get this resolved. Any suggestions are welcome.
Thanks in advance.