[cobalt-security] Hacked server - any advice

["Steven W. Riggins" <geek@xxxxxxxxxxxx>]

Hi,

I set up a server on ISP X for company Y a couple of years ago.  I 
guess neither party were applying cobalt patches.

it seems the server is hacked (according to ISP, they have seen "hacker 
files" but won't tell me which ones)

We're moving to a new ISP, but the server still runs (dishing out web 
pages).  It runs out of memory now, as there are a ton of defunt 
processes (our phps, etc, never seem to quit now)  A lot of cronds are 
defunct too.

Anyone have any idea where I can go to figure out:

a) What we might have
b) How I can remove it (or at least lessen it without a complete wipe, 
as the new server is just about done)
c) How I can stop these processes from going defunct and chewing up ram

Any help would be appreciated.  Oh yeah, the new ISP will keep the 
machine up to speed with patches and does not even let US have root 
access (yay!)

Sincerely,

Steve

Attachment: smime.p7s
Description: S/MIME cryptographic signature