Website Compromised -

Our website is hosted with Network Solutions Virtual Private Servers Last night, they contacted me to inform me that our site had been suspended (all access except FTP) as they had detected an IRC Bot running under the "Apache" user, as well as WordPress and OsCommerce installations. Our current web designer informs us we aren't running IRC, Apache, WordPress or OsCommerce, and that we have been compromised. Network Solution s will not re-activate our account until the issue is fixed. I am looking for someone who can: 1. Diagnose what is causing the security breach 2. Remove the offending application or code 3. Help us submit proof of our changes to Network Solutions to restore our account status In the interim, we are considering uploading our current (infected site) to a temporary web server so that our clients can access our site immediately while these steps occur, but I will defer to you as to whether this will save us any time. We need to start and complete the project as soon as possible. We have two legitimate WebApps--one is a MySQL PHP service agency locator (by zip code) and one is a similar dealer locator based on unknown architecture (I assume its also PHP but I don't want to give incorrect information). I can provide FTP access to download our current site so that you can give me an accurate time frame for diagnosis, repair, etc. Also, we are interested in quotes associated with migrating our existing (primarily HTML) site to be run on the backend by WordPress or some other similar CMS and then a monthly management and design retainer.