hacked need help

[moobymoo]

i have been recently hacked and seems like someone uploaded some mocks and shell script on server and then had added some user with root priviligious

i did remove script and mocks from server..but still one of my account get it's ads changed on a specific time how can it be possible??
is there anyway to secure my server and then track down that problem..some days back i had server crash due to that

[Infopro]

If he got root access, its already too late. Time to go to plan B I would think.

[moobymoo]

what is the plan b

[Silver_2000]

usually it means reinstall of the OS

[mitul]

To be on safer side its better to reload OS.

[moobymoo]

that's what i don't want..i mean reinstall of os..any other way for it??? or that is there anyone who can help

[Specks]

If your box was pwned then its better to reinstall OS than to have to deal with getting out all the root kits he installed to stay in your box.

[compunet2]

No one ever wants to reinstall the OS, but if the boxed is owned then you wont have a choice. Hope you have backups...