Admin's nightmare

I had a nightmare this night: Someone had hacked my server evily. Whatever command I tried to execute, strange log lines appeared on the terminal which looked like shell code installing a rootkit and sending passwords to an e-mail address. He/she even activated an HTTP-proxy which hijacked requests from within my network to some weird other URLs. As additional ‘fun’, the cracker replaced simple commands like ‘ls’ or ‘less’ with some counterpart like ‘rm’, such that I ruined the system more and more by myself. In my dream, I now had to spend all night to set up a new system with a bad feeling about not having enough know-how to conserve the broken system for forensic analysis.

Please, dear crackers, don’t do it like that.