Thnx Dew.*, it's always nice to get feedback (or criticism).

Bri.*, please try to understand this.
Chances are you won't like the tone of voice of this reply, but I won't take the easy way out:

In the absence of information supplied by the user, and being concerned with a possible lack of security, I try to default to giving a basic set of instructions that will give the user and us more info, and can act as a guideline for trying to establish what the damage could be. No place for panic, no 30 rule professional cookbook, just simple information, facts is what we need to help us help you.

Now I don't question anyone's status as a Linux user, or knowledge of securing or using the OS but if a question is asked and the replies then show no sign whatsoever of being able to read and apply what's offered to assess damage in favour of clinging on to a (in this case) rather trivial question of removing "evidence", then what do you expect us to help you with? If you try to see the directory the cracker made as a symptom a somewhat larger problem, then clearly deleting the directory would compare to treating symptoms instead of fixing the cause. And it doesn't help your case stating just now you pulled the box off the net and stopped the ftp daemon; you should have reported that in your initial post.

Finally, if you respectlessly mark all the replies in this thread as "nonhelping posts" regardless of their contents then I would venture you have a problem a multitude larger than a hacked box...

And for me to add,

You haven't really given a straight answer from unspawns first response. Your like the person calling tech support for help but when asked to do something you refuse to do it. If you think all the responses are really non-helpful, then I can close this thread and problem solved.

You have to remember, everyone here is trying to help you in their spare time, your lucky to even get a response and help for free. So I would drop the attitude or just never post another question again. No one really wants to help people when you respond like you have done.

Personally when unspawn replies to posts, I tend to read them, I love reading his responses cause I usually learn something from them I didn't know before. You haven't once clearly stated what you have done or tried except what trying to remove the file, did the chrootkit and unplugged the box from the network. All the rest seemed to be complaints. If you want help, then help us help you or don't ask at all.