Typically when i come across a machine that I believe has been compromised the first thing i do is remove it from the network completely.. If possible i boot it up in finnex or a similar utility tool and then i run clam av via command line after mounting the drives manually.. Next i personally only grab files that are of text nature and to ensure that nothing else maybe attached i use the cat command to display the text of example conf files and then copy and past them into an editor of your choice.. Personally i use Notepad ++ on my windows machine for each one of the files re saving them on my machine.. If I was to guess you were probably root kitted this is common these days however its usually difficult to find the root kits while in the os.. Tools like Finnex are nice because your no longer in that os and generally speaking can search hidden files a little easier.. Still not going to be fun.. What i would recommend in the future is to setup your node the way you want it then clonezilla it or reimage it and store it in a safe spot.. This way if you run into this issue in the future your back up and running in short order..  Just my 2 cents..