You have discovered that your Bastion host has been compromised but cannot determine when the compromise occurred. The best course of action for you to take would be:

A.
Boot to the “Last Known Good Configuration”.

B.
Format the disk and re-install everything from scratch.

C.
Restore from your most recent tape back-up.

D.
Run an Anti-Virus scan on the Bastion host and clean any infected files.

E.
Download and run the patch for the exploit that was used in the attack.