Debian – the server was rooted via h00lyshit exploit, any good advice

So yesterday I found out that my server was rooted via the h00lyshit exploit. So far I deleted all the files that might be asociated with the exploit. I also deleted all the ssh keys in ~/.ssh/authorized_keys. I changed the root password to 25 random character password and changed mysql passwords as well.

Also i think the attacker was from italy, and since i need to have access only from my country i blocked every ip range except my own country, will this help?

Do you guys have any good advice what i should do? I plan to disable root via ssh (i should have done it much sooner, I know 🙁 ). And is there a way to check if he can access my server again?

Also no damage was done luckyly, oh an i'm running Debian Lenny with 2.6.26 kernel if somebody is interested.

PS: yay my first question 😀