[MPDev]

Look for files with a creation or modified date of the day of the hack (or later). I found an IRC relay setup posted in an obsecure directory that I had to remove - they had also placed an entry in the apache crontab to restart itself every 10 minutes that I had to remove.

Check your cron files; check your site directories for new files/directories; try something like:

find . -name "*" -exec grep c99 {} \;

to see if you get any files which have the c99 tag in them (the shell script that are installing).