Hacked 3.8.4 pl1

[CarlitoBrigante]

Definitely. For example, they could have injected a plugin if they hacked your database. Sometimes, they try to mask their malicious code/backdoor into existing plugins. But first, check for all php files in directories where they should not be; then use vB diagnostic tool to check for suspicious files. This find command might help you identify some files:

find . -type f -mtime -5 -name '*.php'

Change the mtime value depending on how back in time you want to go; -mtime -5 will return only files edited in the latest 5 days.

Disabling all shell execution/inclusion functions in PHP, unless you really need them, is also a good idea to stop most attacks. Check this: http://www.cyberciti.biz/faq/linux-u...ble-functions/

Also, try to go through your access logs to determine the point of entry: if you find that, then you have the key to clean-up everything more easily.