Hi,

The error messages you got from 'ls' would mean that that PID 4600 no longer exists - in other words, the process with ID 4600 has since exited. These kinds of things only tend to hang around for so long, and you really need to catch them right in the act to have any decent chance of easily tracking them down. If you see any other suspicious processes still (to recap, that would be processes owned by 'apache' but which claim to be anything other than 'httpd') then have a look at their entries in the /proc filesystem in the same way. But most likely it's all over and done with by now.

Unfortunately, the bigger problem you have here is not in fact the rogue scripts themselves, but the question of how they came to be on your system in the first place. In my experience, an attacker finds something they can exploit, like a file upload form without sufficient security protection, or some other script that they can exploit to make it upload things to a globally-writable location on the server. Once they upload their script, they then run it, it hangs about for a bit while it does its thing, then exits.

So the more important thing you have to do here is figure out how the attackers got these scripts on your system. The fact that they might still be somewhere on your server is certainly a problem, but a bigger problem is the fact that they were able to be on your server at all in the first place. In all likelihood you have a security hole somewhere that could be exploited by the same attacker again, or an entirely different attacker in the future.