Our sites stopped working and when I checked the error log, I saw this:
[Fri Nov 1 08:23:08 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_mjx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2
[Fri Nov 1 08:23:08 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_nx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2!TopLeft
[Fri Nov 1 08:23:09 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_nx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2!Top2
[Fri Nov 1 08:23:09 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_nx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2!Middle
[Fri Nov 1 08:23:10 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_nx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2!Left2
[Fri Nov 1 08:23:10 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_nx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2!Left
[Fri Nov 1 08:23:10 2002] [error] [client 138.89.111.131] File does not exist: /home/sites/home/web/RealMedia/ads/adstream_nx.ads/www.spiegel.de/panorama/1341623901@TopLeft,Top1,Top2,TopRight,Left,Left1,Left2,Right,Right1,Middle,Middle2,Position1,Position2,Frame1,Frame2!Right

I had to reboot twice, but it seems to be okay.

We are fully patched and I did check chkrootkit and it did not alert to anything.

The directory of RealMedia does not exist. I checked. There does not appear to be any strange files.

Looks like someone was beating up on that site.

add that ip to your deny list.

That would do the job.