How to Replace Undeletable Hacked Files on Linux

1. Keep a pristine copy of critical system files (such as ls, ps, netstat, md5sum) somewhere, with an md5sum of them, and compare them to the live versions regularly. Rootkits will invariably modify these files. Use these copies if you suspect the originals have been compromised.
2. aide or tripwire will tell you of any files that have been modified - assuming their databases have not been tampered with.
3. Configure syslog to send your logfiles to a remote log server where they can't be tampered with by an intruder. Watch these remote logfiles for suspicious activity
4. read your logs regularly - use logwatch or logcheck to synthesize the critical information.
5. Know your servers. Know what kinds of activities and logs are normal.

Here are some things to try before rebooting:

First of all, if you think you might be compromised unplug your network cable so the machine can't do further damage.

Then, if possible refrain from rebooting, as many traces of an intruder can be removed by re-booting.

If you thought ahead, and had remote logging in place, use your remote logs, not the ones on the machine, as it's all too easy for someone to tamper with the logs on the machine. But if you don't have remote logs, examine the local ones thoroughly.

Check dmesg, as this will be replaced upon reboot as well.

In linux it is possible to have running programs - even after the running file has been deleted. Check for these with the command file /proc/[0-9]*/exe|grep "(deleted)". (these disappear on reboot, of course). If you want to save a copy of the running program to disk, use /bin/dd if=/proc/filename/exe of=filename

If you have known good copies of who/ps/ls/netstat, use these tools to examine what is going on on the box. Note that if a rootkit has been installed, these utilities are usually replaced with copies that won't give accurate information.