Hacked Linux Box

Someone hacked my Linux box. I was on it at the time, and saw scripts running that shouldn’t. I started killing them, and tried killing as many processes that they were running as possible (some were doing installs). I didn’t get a record of everything that happened.

Eventually, I had to restart the machine.

When it came back up, it had trouble, and wasn’t doing any system logging.

I installed a new sysklogd package using –force (because original attempts to reinstall failed with complaint about a file needed by another version—which wasn’t running and couldn’t be started).

How can I find what else needs to be reinstalled?