[ILUG] rooted!!

[Martin Pegman]

Hi All,
	It would appear that one of my older RH 6.2 boxes has been rooted. 
An lsof -I gives a load of these 
strlib.h   3124 root  172u  IPv4 11059044       UDP *:3860 
strlib.h   3124 root  149u  IPv4 11057595       UDP *:3820 
strlib.h   3124 root  150u  IPv4 11057602       UDP *:3821 
strlib.h   3124 root  151u  IPv4 11057624       UDP *:3822 
strlib.h   3124 root  152u  IPv4 11057642       UDP *:3823 
strlib.h   3124 root  153u  IPv4 11057656       UDP *:3824 
strlib.h   3124 root  154u  IPv4 11057663       UDP *:3825 
strlib.h   3124 root  155u  IPv4 11057682       UDP *:3826 
strlib.h   3124 root  156u  IPv4 11057840       UDP *:3827 
strlib.h   3124 root  157u  IPv4 11057855       UDP *:3828 
shady     32544 root    1u  IPv4  8902706       UDP *:515 
shady     32544 root    2u  IPv4  8902706       UDP *:515 
shady     32544 root    3u  IPv4  8902706       UDP *:515 

apart from what I would normally run.
The enterprising b*&%^x also /dev/null'd my logs for the past week 
so it's going to be hard for me to track but ls was definetly changed.
So I have two questions : 
1. a google on the above give little or no info so apart from securityfocus and 
cert 
	where should I go looking for info 
and
2. has anyone a loan on OpenBSD in the dublin city centre area ? 
blank cd's pints etc in payment.

Thanks
Martin P