Final Results

Based on information I had been supplying them during the investigation, they had already come to the conclusion that a reinstall was called for.

A new system was installed to a new hard drive off-line.

Drive was replaced and the compromised drive removed for off-line investigation.

Latest OS and utilities installed with only the required services present.

Non-shell accounts got /dev/null for a shell.

E-Mail accounts use APOP