I just knew this problem a month ago when one of my friend’s website on my server being hacked and installed a background program. The background program generate huge and useless image and movie files at server.
After hours of inspection at my server, I found the background progam ran under apche’s process. The background program called “footer.gif”. Smart huh? They name the background program as a image file’s name so that people can’t find it.