Comment by derFunk

What's really important is that you never should keep a compromised system like this running, even if you think you found all modifications the attacker did. You probably didn't. So save your configs and set this machine up from scratch.