I have resolved it.................my server is not compromised anymore.
but I still have a question that I found VadimII at 2 locations : /dev/shm and /var/spool/samba and one place it was created with some user and at second location it belongs to some other user. I mean that one place the owner user was different and at the second place the ownser was different.
Both the users belongs to our 2 different clients and I am really wondering that who was the culprit
