Well lets see, taking my limited security and pc forensic knowledge into account: it seems to me that the server is already pretty messed up if someone got root access. Even with my limited know-how i would have a back up server ready to go, and since i am always looking for a reason to smash things, i recently let a container of frosting go bad so i could use it as a baseball, i would most likely back up what i could/needed, take the comprimised server off-line, put the backup on-line, make a new back-up sever, then go out back and play full contact golf with the old server. problem fixed.