I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and where this attack is running. I can not find anything in cron jobs. I am using ssh key-pairs to connect to the server so it is unlikely someone can have hijacked the root account. I did have FTP on the server but I changed to SFTP now. Could it be a PHP page being used for this and how do I find the source? is it possible someone has used a root kit without the root user access?