how to find bad scripts or unwanted processes on an compromised ubuntu server

Question

I got a message from my provider that my server (hosted virtual server) is obviously abusing other servers. Someone complained to receive lots of traffic from my server. It is now on me to find out what's going on my server and how to stop it. Of course I have done all basic steps like changing passwords, updating 3rd party software. But maybe someone could give me some advices what would be good to check as well? Or maybe what kind of steps would you do in such a case? I know, I could hire a professional DevOp and I am planning to do it, but still want to check on my own at first. Thanks