Take a look at the output of ps aux and netstat -pantu for anything abnormal especially irc (psybnc). See if you can find the executable with 'find / -name y2kupdate'.
Take a look at the entries in /etc/crontab and /etc/cron.d for anything abnormal, like:
Code:
* * * * * /var/tmp/sh/.LiveZone/y2kupdate >/dev/null 2>&1)
As root run 'crontab -u apache -l' to display any userdefined crontabs for apache.
Anything weird in your Apache logs (errors, restarts, segfaults, etc)?
