just in case, check 'which su' to see where the binary is taken from. ... View more

Also check your users' .bash_history for strange commands if the hacker/cracker was logged into a bash shell and didn't cover his tracks. Maybe you can use 'find' to see which files were changed recently. You might also want to check for the existence of so-called 'rootkits' on your system. Be careful because standard programs like 'ls', 'ps' and 'top' may have been replaced as well, to hide certain files and processes. I don't know why LILO stopped working, it's usually no use for hackers to break the system entirely. ... View more

My personal flavour is Debian (www.debian.org). If you know which programs you need, just install the required and important packages and then select whatever else you need. Gnome or KDE will be too much for those systems, but the X Window System itself should work, perhaps with fvwm or another small window manager. Blackbox is supposed to be small, too. XFce is a bit like KDE but smaller. Debian install doc lists 12Mb as minimum requirement (without X, I presume) and you definitely will need swap space when running X. For router purposes there are distributions that are only for routers, and these are the best choice if you don't need the machine to run anything else. ... View more

Can't help with the strange files, but I remember from a hacked server at a company I worked for, the intruder had not deleted the .bash_history file. That's always worth a try. Ofcourse, you might want to check any file that has been modified recently. ... View more

or 'split' and 'join' the file in 2Gb chunks. ... View more