StupidScript - 4:52 pm on Sep 20, 2005 (gmt 0)

If indeed it's a 'Nix box. There are similar tools available for MS boxes.

Keep in mind, too, that most rootkits (if one is installed) will mess with the top and ps output, along with removing info from wtmp and cleaning out traces from the normal log files, like /var/log/messages.

If your system has been compromised and taken over completely, you won't be able to do anything but reboot, if that. If it's being used to mount attacks without having been completely taken over, you can probably see the activity by using top or ps aux, but you may be too late to stop it without reinstalling the OS ... you simply cannot tell which system files have been replaced with bogus ones unless you already had in place some mechanism for doing so. If they're compromised now, you won't be able to tell. File timestamps, permissions, all of that can be forged or appropriated.

We really need more details about your server before we can offer any specific advice, like what operating system and version it's running.