[TriLUG] cracked shared hosting: what to do?

[Amnon]

> No, I'm not sure.  All I can say is that nothing stands out immediately. For instance, 'last <username>' only shows my logins, 
> both before and after an attack (i.e., modification of .htaccess and scripts put in

Did you change your password?  We've been seeing a lot of cracking attempts (pop3, smtp) from China in the last few weeks, and a few 
of the 'easy' passwords were cracked.