I basically agree with all the advice given, but the easy-fix-guy in me realizes that it's most likely just replacing a weak password and deleting an easily found botnetscript, and he'll can have the box up and running again.

I guess that's the difference between fixing my private boxes with no sensitive informastion and fixing this guy's 600-site serving box:)