I'm seeing many folders beginning with "ssh" is that normal? Also, noticed a psy folder there it looks like psybnc is installed. I have removed that folder and the psy.gz file.

this could mean serious trouble. bnc must be installed in other places also. (my guess)
check your netstat for any new ports that are open. check ps for suspicious processes. use chkrootkit to see if it detects anything. you would want to see your logs as to where the intruder came in from.
This could probably be some thing like a remote file inclusion in phpbb or something, so check your apache logs.
search for world writeable directories too and see if there is anything installed on them.

oh yeh, I have those folders too, always have (ssh folders). I assume they are harmless.

If you are using ssh then temp folders may be normal, I don't get them with openssh though. Either way they won't be needed after a reboot, so removing the lot and rebooting should work fine (in theory, you can dump the whole of /tmp, but I've found X was a bit picky about that). If you think you might have a security problem then you need to get busy with netstat as w3bd3vil describes.

If you have a psybnc sourcecode in tmp and you didn't put it there, then that is very bad sign. First who owned the file(s)? I would also recommend that you don't delete any more files or directories until you have a better idea of what is going on. Do follow webdevil's advice and look carefully through your apache logs, especially for URLs that have shell commands like wget, cd, etc or contain psy.gz. Don't ignore the issue and delude yourself into thinking everything is ok until you can be definitely sure of that.

The following will give you a good start:
http://www.cert.org/tech_tips/intrud...checklist.html
http://www.cert.org/tech_tips/root_compromise.html

If you have any questions about stuff or don't know what to look for, then make sure to ask.

If ssh-agent is started when a remote client logs in, a subdirectory of this type of name will be created and will contain one symbolic link named agent.PPPP where "PPPP" is
the PID of the agent.

One of these is created automatically when a local GNOME X session is started (probably also for KDE and other GUIs) so that an X terminal started in the GUI doesn't need to prompt for the password.

Check that, the PID is the PID of the process that invoked the agent. On my machine I currently have one such directory and the file is actually
a system file of some sort, not a symbolic link (I think).

...and the PID is that of "gnome-session". So noted regarding edit. :-)

very smart sixerjman I had no idea gnome did that, also for the future you can edit your post to add stuff to it rather than posting two more posts. just saying.

"Pysbnc" (sort of a proxy for IRC clients, or "bouncer" as they call them) is usually the first thing added by script kiddies after a system break-in. If you didn't put it there, you're definately hacked. Worse, many times pysbnc (and other tools from these types) is infected with linux virus RST (judging from the samples I've collected over the years).

It's looking like re-build/re-install time...