What has been compromised?
Was it a shell account with extended privileges or mysql?
Do you feel you need to preserve evidence for an investigation or are you just trying to get back online ASAP?
If it was mysql, the first step I would take is to prevent access from externally by setting the below in my.cnf. Once you have this you can start to take stock of the situation.
bind-address = 127.0.0.1
If you are concerned about mysql changes then a very simple way is to do an mysqldump of the db from now and compare it to one in your offsite backup from before the compromise. It will be quite verbose but should highlight the changes to you.
As far as I am aware, mysql only logs changes if you have it set in debugging mode but this is slow and verbose and not recommended at all.
If you suspect your shell account has been compromised then I would suggest you carefully examine /etc/passwd /etc/group etc and then start the process of building a more secure environment and shifting your application to it(there is a much longer post required about this which I'm not able to do right now but am sure someone else will be able to help ).