해킹의심되는데...확인 및 해결책 알려주세요.ㅠㅠ

몇일전부터 DOS 공격을 너무 받아서 점검 하던 중

bd 라는 이상한 파일을 발견...
strings bd 로 보니

/lib/ld-linux.so.2
libc.so.6
strcpy
waitpid
ioctl
stdout
execve
memcpy
perror
dup2
socket
select
fflush
bzero
setpgid
accept
write
kill
bind
__deregister_frame_info
chdir
memchr
signal
read
htonl
listen
fork
sprintf
htons
exit
_IO_stdin_used
__libc_start_main
strlen
open
vhangup
setsid
__register_frame_info
close
__gmon_start__
GLIBC_2.0
PTRh
pqrstuvwxyzabcde
0123456789abcdef
/dev/ptmx
/dev/pty
/dev/tty
socket
bind
listen
PsychoPhobia Backdoor is starting...
OK, pid = %d
/dev/null
/var/tmp
HOME=%s
Can't fork pty, bye!
/bin/sh

이처럼 나왔습니다.

그래서 lsof -c bd 했더니

COMMAND   PID USER   FD   TYPE   DEVICE      SIZE    NODE NAME
bd      19133  www  cwd    DIR      8,8      4096       2 /
bd      19133  www  rtd    DIR      8,8      4096       2 /
bd      19133  www  txt    REG      8,2     19242  441898 ./bd
bd      19133  www  mem    REG      8,8             73139 /lib/ld-2.3.6.so (path inode=73147)
bd      19133  www  mem    REG      8,8             73146 /lib/tls/libc-2.3.6.so (path inode=73156)
bd      19133  www  mem    REG      0,0                 0 [stack] (stat: No such file or directory)
bd      19133  www    0u   CHR      1,3               577 /dev/null
bd      19133  www    1u   CHR      1,3               577 /dev/null
bd      19133  www    2u   CHR      1,3               577 /dev/null
bd      19133  www    3r   REG      8,3       136  358994 /var/logs/mod_throttle.runtime
bd      19133  www    4u   REG      8,7         0      35 /tmp/ZCUD14JCQ2 (deleted)
bd      19133  www    5u  IPv4 27958533               TCP *:1666 (LISTEN)
bd      19133  www   15w   REG      8,3 416130642   48866 /var/weblog/apache_errors.log
bd      19133  www   16w   REG      8,9         0 3679310 /backup/weblog/www-error_log
bd      19133  www   17w   REG      8,9   4544168 3744611 /backup/weblog/xxxxxx-error_log
bd      19133  www   18w   REG      8,9   3410859 3679207 /backup/weblog/xxxxxxx-error_log
bd      19133  www   19w   REG      8,9     10350 3679260 /backup/weblog/xxxxxxx-error_log

이하생략;;;

처럼 에러로그를 검사하고 있더군요

해킹이 맞다면 어떻게 처리해야 하는지 알려주세요..ㅠㅠ