The fact that so many standard logfiles have been changed into directories is suspicious, but it *might* be a configuration problem with logrotate or similar utility.
But looking at your process listing I noticed that "ps aux" lists many processes as "ps wax" and "grep irq", the "ps -el" lists those same processes as running "tblockd". This is most definitely not normal!
Google does not find any significant hits on "tblockd", so it is not likely to be a normal part of the system.
I also see "pure-ftpd", multiple SSH connections as root, and various processes related to Xen virtualization on this host.
In light of this, the fact that log files are changing into directories becomes very suspicious too. Maybe someone does not want the logs to be there?
I'd say you have been attacked with some significant degree of success: an intruder seems to have root access to your system!
The intruder is probably running some software that tries to mask the intruder's processes running on the system, and has been only partially successful.
These types of software are generally known as "root kits" and are purposefully made to resist removal.
Take backups of all important data on the system *NOW* but don't overwrite any old backups: you may need them too.
Be prepared to re-install the entire operating system: it is the only way to be absolutely sure that all the intruder's malware is gone.
If you wish to analyze what has been done, boot the system with some Linux Live-CD and use it to examine the filesystems or backup them for forensic purposes: the system's own kernel can not be trusted to be truthful any more.
The attack may have come from the internal network too: if someone has brought in a laptop or other machine that was already infected with a worm program, it may have been able to automatically attack your server. Once the machine has been contaminated somehow, an outgoing connection to the Internet is enough to allow an intruder to remotely control it as a part of a botnet.
Maybe your server is behind the firewall now, but was it always so? Was the server installed for its current role, or was it re-purposed without reinstallation? If so, was it less well protected before?
MK
MK
