You need to back up your own data and wipe and reinstall the server. You can never trust a system once it's been breached; you don't know what trojans or other code paths have been inserted on the server. Sealing the breach won't stop what has already been altered internally!
Hopefully you have backups from before the breach occurred. Otherwise you may have trouble knowing what can be trusted on the system. Worse, your system can be used as a platform from which to launch other attacks or monitor traffic from other systems on the network.
After you reinstall fresh and then do all the updates, you may need to look and see if you can find where the breach occurred (or did you already find it?). Were there unnecessary accounts open? Unnecessary services? Anything in the logs? Are you the only authorized user on the system?
You could also look at a program like Tripwire for monitoring alterations to the filesystem. May help with tracking what is replaced down the road. Also use programs like rkhunter for finding known trojans, scanning periodically and have results emailed to you.
I didn't see if you're running Windows or Linux, but the above tools are for Linux systems. I am not sure what you'd use for Windows...