Tis the season for misery

Hi all: I have now been "hacked" on 2 servers and (excuse the pun) I am hacked off with the whole thing. On the latest one, the server appears fine but the root password has been changed (man in the middle?). One of my isps just said back up the main data and re-image the machine. That seems somewhat excessive? I have access to revovery mode and all my files are mounted. What should I do??? Paul -- Sizofik a Ninila' Siyakhona? ポール