MySQL hacked?

MySQL went down on my server a few hours ago, but cPanel said it was still up and running.. then after a while it came alive again when I didnt even do anything. Obviously something is wrong, and it sounds like a problem with the symlink in the tmp directory which may have been modified/deleted by a hacker?
The error that i received when trying to connect through php was:
Warning: mysql_connect(): Can't connect to local MySQL server through socket '/var/tmp/mysql.sock' (2)

Anyway I took a look in my tmp and found some strange folders, are these normal?

Code: 
root@venus [/tmp]# ls -al /tmp
total 80
drwxrwxrwt    5 root     root        20480 Jul 14 09:49 ./
drwxr-xr-x   21 root     root         4096 Jun 11 08:44 ../
drwxrwxrwt    2 xfs      xfs          4096 Jun  6 21:14 .font-unix/
drwx------    2 root     root        16384 May  7 22:04 lost+found/
lrwxrwxrwx    1 root     root           25 May  8 04:07 mysql.sock -> /var/lib/mysql/mysql.sock=
-rw-------    1 nobody   nobody          0 Jul 14 09:30 sess_0ec6c2a4b669aff6ae423065a336ff5b
...
-rw-------    1 nobody   nobody          0 Jul 14 06:00 sess_feee90b71229e5a2e7d84cb891b754ee
drwxr-xr-x    3 demo     demo         4096 Jul  2 19:33 za/

 

 

 

 

Top