For The admin server who was hacked ..
what is your Ubuntu kernel version
and i wanna tell ya ..rk-hunter don`t work all the time .. belive me ..
) .. if .. the rk is a troian .. yes is possible to be detect .. if is not .. then you have a problem .. or .. if the man who enter on your comp .. don`t put a rootkit on him .. then you'll have a prob ..
try a socklist .. and see the ports ..
if you are intrested to talk more about that .. firstname.lastname@example.org