First change the root password, and get your security administrator to check the complete server and remove all vulnerable scripts, delete unwanted users if they have been created etc...