There is something I want to say...
If you're being hacked, you can't trust netstat, ps, your log files, root kit detector, or what so ever. They should all be altered by then, and their time stamps restored. (infact, one could grab the source of 'ps' and change+recompile it so it doesn't display a few programs)
The most important thing to do is, shut down any network service you don't use. Don't work as root all the time, and try to set up a firewall with iptables yourself. (you should be safe if you're behind some router/nat box, because they usually drop incoming connections)