Posting this quickly so that others can check their systems for signs.
ls -ahl /usr/lib/.x/
If that shows you files on your server you have been hacked just like we seem to have been on serveral servers. (All ISPConfig3 servers.)
Powered by ISPConfig 126.96.36.199
Debian Lenny 5.0.3 (OpenVz) Proxmox 1.4
Linux server44 2.6.24-7-pve #1 SMP PREEMPT Tue Jun 2 08:00:29 CEST 2009 i686
Seems like some kind of IRC Bot.