Did you keep your system updated to the latest?
Is this a custom programming job? If so you need to find out if it was some kind if injection or bug and fix it.
If it was a case of not keeping up to date with vulnerability fixes and/or updates, you need to wipe and start over with a clean backup and then update it to the latest. You can't trust that it wasn't altered with backdoors. Even rootkit checkers can be fooled or not have checks in place for everything; there will always be the possibility the intruder left behind some "gifts" for you.
After you get it restored, install something like Tripwire that keeps MD5's of your files and that will help with finding alterations to system binaries (of course, don't keep the compare file on the same server). It'll be a pain, but it's the only way to make sure your system binaries aren't compromised in the future.
Summary; your system's been hacked, you can't trust it. Find what caused the intrusion so you can plug the hole, restore from a backup, fix the hole, put measures in place to monitor the system in case of future intrusion.