How do I deal with a compromised server?
serverfault.com