hack attempt?

k i've been going crazy i think someones been hacking into my webserver but i don't know how to be sure typing "last" at the command line returns a list of past logins but also on that list is reboot system boot 2.4.4-4GB [date] [time] (01:20) and my messages.log file is cleared to that date ie, i have no entries from before october 9th @ 11:49 the time this "reboot" happened does anyone know what's going on? any suggestions?