Headless miner getting hijacked

[charmees]

I have headless miner running on smos.
Every hour some hacker closes my mining session, and starts mining to its own pool

I have been debugging around, here are some facts

*changing user and root password did not help
*changing ssh port did not help
*hacker does not change cgminer configuration, I can just see that it has started mining litecoin, but my configuration stays the same
*he added one item to crontab, that sends emails about my ip to his mailbox every 3 hours, removed that, still gets in to my machine

any suggestions how to block it? considering that I still want to access my machine from internet.

[hotwired007]

rebuild it - most likely they've installed something on it for remote control.

[notlist3d]

rebuild it - most likely they've installed something on it for remote control.

Rebuild and also most important DO not log into important things from this computer if known to have some form of virus.  Reevulate what site's and downloads you have done so it does not happen again.  Install a virus protection.

If you had a wallet file on that computer create a new wallet on another computer and send coins to it.  MAKE SURE that computer does not have the same software you talk about on miner.