Nothing like getting a call in the AM saying, "I think we've been hacked".
Got it under control now, I think. The processes watching each other, and thus respawning when one is killed, have been isolated with kill -STOP.
Load averages have dropped from the mid 50s to 0.02.
Now to clear out the SysV init section so they don't respawn on reboot.
Running md5sums on everything. Will replace the diddled-with services. Already did that with the usual suspects (ps, who, top, etc)
I hate my life.