A great link from @spolsky to a checklist on what to do if your server has been hacked. I'm sure there are other things, but it's definitely a good place to start, and the users on Server Fault know what they're talking about.