Passwords (Security Admin)
Continue to monitor for new and changed file, things the user didn’t do
Look for back doors left behind by the intruder such as the .rhosts file
Check the password file for new accounts
Look for other sites the user went to. Contact those sites and let them know that they have a hacker.