I have a simple question for you, well, at least, much simpler than "How do I clean up a compromised user account?" The question is: "How do I disable a compromised user account?" There are some obvious things to do:
- Disable logins for the user (we've done this by changing their home directory to /disabled/home/user)
- Disable the users Apache websites (once again, but replacing with bogus paths.)
- Killing off all the users processes using
pkill -9 -u username
- Checking they have no spooled cronjobs
So, if their processes mysteriously come back after doing these things, what did we miss?