I stumbled across this interesting post on how a system administrator investigated and secured one of his compromised servers. He talks you through his investigative process, methods for cleaning up the compromised server and points to plenty of resources and tools for locking down your server.