Do you have ssh access?
If so, find files that were last updated in the past week or so.. and look through to see what they are. Once you find the hacked files, restore from a backup (database and files) from before that time. If you can't find anything that was changed (like if they modified things in the database), then pick a known-good point and restore from then.
|