The first symptom was that I couldn't connect on port 6667, thus falling of irc-servers (and was unable to connect to them again). After some tcpdumping etc. I couldn't figure out what caused this, and upgraded my system then rebooted. After the server came up again, I managed to reconnect to irc-server, but when accessing the my web files, the browser displayed a "split header received"-message. On a hunch I connected to port 443 on my web server (through the browser) which displayed page with heading: "Remote Access Controller", which seem to be a Dell tool. The funny thing is that I have no notion of installing/having such a tool. The only similar tool I got is an IPMI-interface (this is a Supermicro server). After a few minutes this response went away, and the website got displayed as usual.
So, have I been rooted, and the attacker installed a Dell tool? The various logs didn't show anything suspect (afaik), so please help me how to further investigate this issue =)
Stuff I have done to detect malicious behaviour:
- unhide (for checking processes)
- Have searched / for weird directories
None of these approaches have revealed anything suspicious. Of course, the tracks of an eventual rootkit could be hidden.