Prior to this ( a few hours) i had ftp requests for '/etc/pw.db' and
'gethostbyname' that were
refused  and socket not connected respectively.

 Meanwhile, the transfer is still going on 30 minutes later. I killed the
ftpd, and snooped around. I ended up deleting the incoming dir.

When i did this i found out where the 40% of the slice was being used. The
thing is, they(all the files) were all invisible to root. How is this
possible?

What can i do to prevent this, besides not run the ftpd? Any thoughts would
be appreciated.
                Vince

Several possibilities.  Assuming you are really correct in what you
say, it's probably that the files aren't linked into the filesystem
any more but are still open.  It's also possible that the machine was
hacked, but that is a relatively distant possibility.  Before getting
worried about these things, I'd recommend rebooting to make sure that
the disk state resynchronizes.  

You can't do much to avoid it until you figure out what "it" is.  You
don't actually know what happened.  The only other note is that I
wouldn't advise allowing anonymous uploads at all...

Good luck.

It sounds like a process was writing into the directory you removed.  If you do
a du, the output most likely shows the correct amount of disk usage. Try using
either lsof or fstat to find out if there is a process is "writing" into the
old directory, otherwise, on your next reboot, the system will report
correctly.

Corey