Force users' to change passwords before next login Since the worst should be assumed, all users' passwords should be expired immediately. This will force users to change their passwords upon next login. Most likely users on the compromised system also have accounts on other systems, in particular UITS systems. Again, since the worst has to be assumed, those users' passwords on all accounts have to be treated as recommended in the previous paragraph. Such accounts represent a significant security threat and thus need to be disabled or better deleted.
Configuration files have to be examined and cleaned as well.
It is important to understand that re-installing the system from a backup is NOT recommended, as the backup files may have been also compromised. However, without performing the steps recommended in the following paragraph, one's system will not be sufficiently secure to prevent a similar intrusion. Please, read carefully the instructions pointed at by the link below.