While it seems to be a reflex both new and seasoned Linux admins fall for and while information can be gleaned from existing files, killing processes without recording details first does not help or...
Invaders don't want you to know your system's been compromised, so try to interfere with it as little as possible while still using it for their own purposes.