My server's been hacked EMERGENCY
We have a remote Linux (Debian) server, which is, apparently, being used as a platform to commit a DoS attack. We have been warned by the company hosting our server that we have a large amount of outgoing traffic from that server.
What I want to know is: how can I track, and eventually kill, the process which is causing this large amount of traffic?
I've played around with something like this before but it was a while ago and I think I remember using 'lsof' to track the process. However, lsof isn't installed on this server and, having never installed anything on Linux before, I don't really know how to install it.
I'd appreciate any advice or guidance on this matter but the main question is basically how do I track the malicious process?