Someone guessed the password of a superuser on an Ubuntu server. How to make sure nothing malicious was installed?

The breech should be fixed now but is it possible to check for any DDoS malware installed on the server or some other malicious software? What are the recommended steps now short of reinstalling everything?