how do you find out how your server is compromised

My servers been hacked, I'm putting a spare up but I'm at a loss as to see where it's been compromised.

I'd had a couple of email warnings about it portscanning and high server loads.

Are there any good how-to's or tutorials to help track down the problem, I don't want to put a new server up and for the same thing to happen.

Thanks, Rob.

 

 

 

 

Top