Linux System Compromised, Hacker In As "root"

I've been trying to fight off a hacker's attack for the past 24 hours. Chronologically, this is how the events evolved:

- Yesterday, I tried SSH-ing into my server as usual and I got an error saying that the host's key was not recognized, which made a bit suspicious

- I tried logging into my VPS' PowerPanel, but my root password did not work, which I found disturbing. I reached out to support and they reset the password

- I ignored Putty's warning and SSH-ed into the server and was greeted by this, which I've never seen before:

Code:
Last login: Wed Mar 14 2007 14:13:35 -0500
No mail.
This made even more conscious and I started actively searching for indicators of a breach.

- The following processes were running, and I did not recognize them:

Code:
named 15756 0.0 0.4 36088 2256 ? S Mar14 0:00 /usr/sbin/named -u named -t /var/named/chroot

dmorg 26360 0.0 0.1 2264 872 pts/2 T 20:40 0:00 sh -c (cd /usr/share/man && (echo ".ll 14.2i"; echo ".pl 1100i"; /usr/bin/gunzip -c '/usr/share
dmorg 26361 0.0 0.1 2264 512 pts/2 T 20:40 0:00 sh -c (cd /usr/share/man && (echo ".ll 14.2i"; echo ".pl 1100i"; /usr/bin/gunzip -c '/usr/share
- Then I found a user called 'pma' in the /home directory, which I had never created. I could not find any suspicious files in the user's directory

- I finally spotted the point of breach in /var/log/messages:

Code:
Mar 15 15:05:25 xxxxxxxxx passwd(pam_unix)[28121]: password changed for root
Mar 15 15:06:34 xxxxxxxxx su(pam_unix)[30182]: session opened for user news by (uid=0)
Mar 15 15:07:16 xxxxxxxxx su(pam_unix)[30182]: session closed for user news
Mar 15 15:22:04 xxxxxxxxx sshd[20118]: Listener created on port 22.
Mar 15 15:22:04 xxxxxxxxx sshd[20119]: Daemon is running.
Mar 15 15:28:01 xxxxxxxxx su(pam_unix)[32568]: session opened for user pma by (uid=0)
Mar 15 15:28:45 xxxxxxxxx su(pam_unix)[32568]: session closed for user pma
Somehow they had gotten in as root and then opened sessions for news and pma.

- This morning I finally found where the hacker's files are hiding. He had created a new user overnight and a directory in there called "...". The folder contains various files:

Code:
[root@xxxxxxxxx root]# ls -al
total 445
drwxr-x--- 8 root root 1024 Mar 16 15:48 .
drwxr-xr-x 20 root root 1024 Mar 16 15:48 ..
drwxr-xr-x 2 1004 1004 1024 Dec 17 08:57 ...
-rw-r--r-- 1 root root 1126 Aug 23 1995 .Xresources
-rw------- 1 root root 14641 Mar 16 15:47 .bash_history
-rw-r--r-- 1 root root 24 Jun 10 2000 .bash_logout
-rw-r--r-- 1 root root 234 Jul 5 2001 .bash_profile
-rw-r--r-- 1 root root 176 Aug 23 1995 .bashrc
-rw-r--r-- 1 root root 210 Jun 10 2000 .cshrc
-rw------- 1 root root 38 Jul 26 2005 .mysql_history
drwx------ 2 root root 1024 Mar 15 18:01 .ssh
drwxr-xr-x 2 root root 1024 Mar 15 15:21 .ssh2
-rw-r--r-- 1 root root 196 Jul 11 2000 .tcshrc

Code:
[root@xxxxxxxxx root]# cd "..."
[root@xxxxxxxxx ...]# ls -al
total 420
drwxr-xr-x 2 1004 1004 1024 Dec 17 08:57 .
drwxr-x--- 8 root root 1024 Mar 16 15:48 ..
-rwxr-xr-x 1 1004 1004 141817 Sep 3 2001 init
-rw-r--r-- 1 1004 1004 113482 Mar 15 15:09 log
-rw------- 1 1004 1004 640 Feb 18 05:34 messages
-rw-r--r-- 1 1004 1004 664 Feb 27 01:12 muhrc
-rwxr-xr-x 1 1004 1004 165596 Nov 2 2004 pico
-rw------- 1 1004 1004 5 Mar 15 15:09 pid
[root@xxxxxxxxx ...]#
- Here's what's in the log file:

Code:
[root@xxxxxxxxx ...]# less log

[Thu 08 May 08:03:27] + ---------- NEW SESSION ----------
[Thu 08 May 08:03:27] + muh version 2.05d - starting log...
[Thu 08 May 08:03:27] + listening on port 6667.
[Thu 08 May 08:03:27] + muh's nick is 'StefanG'.
[Thu 08 May 08:03:27] + trying server 'geneva.ch.eu.undernet.org' on port 6667...
[Thu 08 May 08:03:28] + tcp-connection to 'geneva.ch.eu.undernet.org' established!
[Thu 08 May 08:03:29] + connected to 'Geneva.CH.EU.Undernet.org'.
[Thu 08 May 08:03:30] + caught client from 'pcp02588223pcs.shlb1201.mi.comcast.net'.
[Thu 08 May 08:03:45] + authorization successful!
[Thu 08 May 08:03:45] + reintroducing channels...

[Thu 08 May 08:07:54] + ---------- NEW SESSION ----------
[Thu 08 May 08:07:54] + muh version 2.05d - starting log...
[Thu 08 May 08:07:54] + listening on port 6667.
[Thu 08 May 08:07:54] + muh's nick is 'StefanG'.
[Thu 08 May 08:07:54] + trying server 'eu.undernet.org' on port 6667...
[Thu 08 May 08:07:55] + tcp-connection to 'eu.undernet.org' established!
[Thu 08 May 08:08:05] + connected to 'Diemen.NL.EU.Undernet.org'.
[Thu 08 May 08:08:05] + caught client from 'pcp02588223pcs.shlb1201.mi.comcast.net'.
[Thu 08 May 08:08:05] + authorization successful!
[Thu 08 May 08:08:05] + reintroducing channels...
There is a whole lot of these in that log file, and the timestamps look odd. I am not sure what all this is.

- This is where I am at right now. Can you guys help figure this thing out?
How did they get in? What sort of vulnerability are they using? How can I patch things up?

- Here is my server info:

Code:
[root@xxxxxxxxx ...]# uname -a
Linux xxxxxxxxx.org 2.6.9-023stab033.9-enterprise #1 SMP Tue Dec 5 14:40:57 MSK 2006 i686 athlon i386 GNU/Linux

[root@xxxxxxxxx httpd]# vmstat 5 5
procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu----
r b swpd free buff cache si so bi bo in cs us sy id wa
1 0 0 390688 0 0 0 0 0 0 0 8365 1 0 99 0
0 0 0 390524 0 0 0 0 0 0 0 0 0 0 100 0
0 0 0 390524 0 0 0 0 0 0 0 0 0 0 100 0
0 0 0 390528 0 0 0 0 0 0 0 0 0 0 100 0
0 0 0 390528 0 0 0 0 0 0 0 0 0 0 100 0

- I have Apache & MySQL & PHP running. I host 3 websites. They run Simple Machines Forum 1.1.2, phpMyAdmin, phpcollab, awstats and that's about it.