It looks like someone got root access to the server.
There are many exploits to get root access.
Here are some tools to check for and fix rootkits
http://www.chkrootkit.org
My advice:
Eliminate any backdoors (rootkit)
Restore the domains
Change all user and root passwords
Verify linux and apache are up to date.