I find most of these management companies suck, don't do anything more than what you can hire someone "one time" to do...
Cleanup after a hack is quite tricky; in all honesty it can take a lot of time to cleanup...
There are a few things you can do, for starters, monitor "top" (it's a command that shows in real time what commands are being run) for anything suspicious, especially if owned by the apache user.
You can also check cron to ensure nothing "out of the ordinary" is set to run.
Now, the fun part, finding out what script has been installed that people can regain access; usually it's something mudayne and just sits around waiting for them to call it; and it can be anywhere web-accessable (likely within the web-home of the site which got hacked).
Lot of places to look, lots to check... I used to do security sweeps nightly when I worked for a webhost, there can be quite a few common locations to stash things, and a quite a few things that get installd (and quite a few locations to install them in!).
If you have slocate set to update daily (I myself do, I find it an excellent way to keep files in the db updated and ready when I want to be a paranoid freak) and do this: locate /...
Why 3 dots? Well, these dolts want you to think "oh, if .. brings me down a directory, and . brings me to the same directory i'm in, the ... isn't out of the ordinary"; likely you'll end up finding a bnc or five installed on the server, eggdrop bot's, pretty much anything your datacenter doesn't allow
...
A lot of differant groups target differant scripts, so that may also be a decent start...
</end 5.20a ramble>
