What's really important is that you <i>never</i> should keep a compromised system like this running, even if you think you found all modifications the attacker did.
You probably didn't.
So save your configs and set this machine up from scratch.