I found something intresting here:

Rpc has a bug which a usesr can exploit and get root access.


http://www.cert.org/advisories/CA-2000-17.html

nowait root /bin/sh sh -i

I had that on mine last month. I suspected an attack and reinstalled, guess I was right :)